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INTRODUCTION 


This  document  contains  the  formal  specification  of  the  kernel  and 
trusted  processes  of  the  kernelized  VII  operating  system  (KVft/370) . 
The  specification  utilizes  the  specification  languago  INA  JO,  a 
proprietary  product  of  System  Development  Corporation.  INA  JO  is 
described  in  TM-6021/000/B0,  January  1978.  This  document  assumes 
familiarity  with  INA  JO. 


The  specification  is  divided  into  two  main  parts.  Chapter  two 
contains  the  specification  of  the  kernel,  and  is  split  into 
nineteen  sections  corresponding  to  the  main  areas  of  functionality 
of  the  kernel.  For  the  most  part,  little  or  no  explanation  of  the 
kernel  specification  is  provided;  a  prose  description  of  each 
kernel  function  is  contained  in  "Preliminary  Design  of  Security 
Kernel  for  KVH/370",  TH-S855/200/00,  October  1977.  Chapter  three 
contains  the  specifications  of  the  trusted  processes.  Each  of  the 
five  trusted  process  descriptions  has  tuo  subsections.  The  first 
subsection  for  each  trusted  process  contains  a  prose  description 
of  the  process,  detailing  its  function.  The  second  subsection 
contains  the  INA  JO  specification  of  the  process. 
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2.1  KVM  Security  Policy 


2.1:  KVM  Security  Policy 


This  section  describes  the  security  policy  implemented  by  KVH/370. 
A  security  level  is  defined  as  an  ordered  pair  (L.C),  uhere  L  Is 
one  of  (Unclassified,  Confidential,  Secret,  TopSecret),  and  C  Is  a 
(possibly  empty)  set  of  special  aocess  categories  (e.g..  Crypto, 
Atomic  Energy).  A  function  'Dominates'  Is  defined  uhich 
represents  the  concept  ’greater  than  or  equal  to'  as  applied  to 
security  levels.  The  types  of  access  uhich  can  be  granted  and  the 
concept  of  an  access  history  are  defined.  The  access  history  is 
an  ansuer  to  the  question  "has  subject  S  ever  had  read  or  ur ite 
access  to  object  0?" 

The  security  criterion  for  the  system  is  defined  in  two  parte. 
The  first  is  the  non-di sere t ionary  policy  and  requires  that: 

(1)  a  subject's  clearance  must  dominate  the 

classification  of  any  object  to  be  read;  and 

(2)  a  subject's  security  level  must  exactly  equal 
that  of  any  object  to  be  written. 

The  second  part  consists  of  the  discretionary  need-to-knou 
controls,  implemented  as  access  control  lists  ahlch  specify 
whether  or  not  a  given  object  is  protected  against  a  particular 
type  of  access,  and  uhich  subjects  may  have  the  specified  access 
to  the  object. 
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epee i  f  i cat  ion  KVIVSecur  i  ty»-Kernel 
module  TopLe.el 

Av  Definition  of  Security  Level  and  related  Functions  it/ 

type  HiarchyLvl  -  (Unclassi f ied.  Confidential,  Secret,  TopSecret), 

Spec i a  I  Pro  tec  t i onCompar  tmen t , 

Categories  -  set  of  Spec ia iProtecti onCompar tment, 

Class  -  HiarchyLvl  ><  Categories 

constant  LouLevel  ■  L"H:HiarchyLvl  (A"J:HiarchyLvl  (H  <•  J)).l  AvUnclaaal  f  led*/, 
HighLevel  L"Hj HiarchyLvl (A"J:HiarchyLvl  (H  >-  J)).l  AvTopSecret*/, 

SystcmLou  ■  (LouLevel,  empty), 

SystemHigh  -  (HighLevel,  S"C:SpecialProtectionCompartment  (true)  ) 

constant  DOMINATES (dominator:  Class,  dominated:  Class)  ■ 

(nominator. 1  >«  dominated. 1  &  dominator. 2  »-  dominated. 2) 

MergeUp (A:  Class,  B:  Class) 

(  (A. 1  »  B.l  ->  A. 1  <>  B.l).  A. 2  li  B.2  ) 

Mer geOown (A:  Class,  8:  Class)  -• 

(  (A.l  <  B.l  ->  A.l  <>  B.l),  A. 2  88  B.2  ) 


Av  subjects  and  objects  i »/ 

type  Object,  Subject  <  Object,  AccessType 

constant  None,  Readonly,  ReadUrite  sAccassType 
distinct  (None,  ReadOnly,  ReadUrite) 

var iable  GrantedAccess  (Subject,  Object):  AccessType, 

Secur i tyLevel  (Object):  Class, 

Trusted  (Subject):  boolean 

Av  access  history  */ 

variable  ReadAccessObtained(Subject,  Object), 

Ur  i  teAccessOb ta i ned (Subject,  Object):  boolean 

Av  non-di scret ionary  security  >•./ 

criterion  A"S:Subject.  OsObject  (TRUSTED(S)  I 
/it  "Security  Property"  it? 

(ReadAccessObta i ned (S, 0)  -> 

Oom i nates (Secur i tyLevel (SI ,  Secur i tyLevel (0) )  ) 
/it  "Vf-Proper  ty"  it/ 

&  (Uri teAccessOb ta i ned (S, 0)  -> 

Secur i tyLevel (S)  ■  Secur i tyLave l (0) )  ) 

/it  Discretionary  Need-to-Know  Access  Controls  it/ 

type  AccessList  ■  structure  of 

(Read  -  set  of  Subject, 

Urite  -  sat  of  Subject, 
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Protr  ■  boolean, 

Protu  •  boolean  ) 

var  i  ab  I  e  D  i  rec  toryAccess  (Sub  jec t , Ob  jec  t h  AcceeeType, 

ACL (Object) i  AccessList 

criterion  A"S»Subjoct,  OtObject 
(  Trusted(S)  I 

Av  read  access  protection  */ 

(ReadAccessObtained(S,0)  4  ACL (0) .Protr  -> 

Sc  (ACL  (0). Read  II  ACL(O)  .Ur  I  te)  > 

Av  ur  i  te  access  protection  #/ 

&  (  Ur i teAccessObtained(S.O)  &  ACL (0) .Protu  ->  Sc ACL(O) .Ur I te) ) 
Av  The  input  parameter  "R"  used  in  these  specifications  corresponds 
to  the  parameter  "REQUESTER"  in  the  informal  specifications 
according  to  the  foi lowing  assertion, 
wiich  holds  for  all  Kernel  calls 

E1"R:  KProcBlok  (RcProcessLi  st  &  R.Procname  ■  Requestor) 

R  is  the  KProcBlok  uniquely  defined  by  the  above  ft/ 
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2.2  Machine  Sped ficat ions 


2.2;  Machine  Sped ficat ions 


This  section  contains  the  machine-defined  structures  and  data. 
The  reader  interested  In  more  details  about  these  machine- 
dependencies  is  referred  to  "!Bf1  System/370  Principles  of 
Operations”,  GA22-7000-5.  International  Business  Machines 
Corporation,  August  1976. 


Ay  SYSTEM/370  MACHINE  OEFINED  STRUCTURES  AND  DATA  ft/ 

Ay  Address  Translation  (OAT)  Structures  ft/ 
type  Byte 

type  PagcQfBytes  *  T.''l_!  list  of  Byts  (C"L  •  PageS ize*1024) 

/*  real  page  frame  address  ><  validity  ft/ 
type  PageTableEntry  ■  VPage  ><  boolean 

/*  For  data  structure  purposes,  page  tables  are  thought  of  as 
containing  the  addresses  of  the  pages  they  refer  to, 
and  segment  tables  as  containing  the  page  tables  */ 
type  PTEList  -  list  of  PageTableEntry, 

PageTable  -  T”P:  PTEList  <C"P  -  PagesPerSegment) , 
SegmentTableEntry  -  PageTable  ><  boolean, 

STEList  -  list  of  SegmentTabioEntry 

/ft  storage  keys  ft/ 
type  ProtectionKey. 

KeylnStorage  »  structure  of 
(Key  -  ProtectionKey, 

NoFetch  ■  boolean. 

Refer  •  boolean.  Change  »  boolean) 
constant  Key0:  ProtectionKey 

/*  Addressing  Technique  ft/ 

type  VPage  ■  T " 1 1  integer  (0  <■  I  &  I  <  18ftl024/PageSlze) , 

ByteOffset  -  T"Is  integer  (9  <«  I  4  I  <  PageS izeftl 024 ) , 
Address370  «  VPage  ><  ByteOffset 
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2.3t  Paging  Parameters 


This  section  defines  the  parameters  and  data  types  controlling 
paging  and  address  space  manipulations. 


/■»>  paging  system  constants  */ 

constant  PageS l2e  -  2  /*2K-2048*/,  Segments ize  ■  64  /*64K -65536*/, 
PagesPerSegment  >  Segments ize/rageS ize  /*32*/, 

PageTableEntrySize  ■  2  /*Hal fuord-2  bytes*/,  PageTableHeaderSiz#  »  8 
SegmentTab I eEntryS i ze  -  4,  SegmentTab I eHeaderSi ze  -  0, 

SuapTab I eEntryS i ze  -  8,  SuapTableHeaderSize  «  8, 

PageTableSi.’.e  -  PageTableHeaderSlze 

+  P*qesPerSeqment*PageTableEntrySI ze, 

SuiapTab I eS i  ze  -  SuapTableHeaderSize 

+  PagesPerSegment  *  SuapTableEntrySize, 

RoundSegments (X:  VPage)  -  (X  +  PagesPerSegment  -  1) /PagesPerSegment 
Av  type  definitions  for  virtual  address  structure  */ 
type  Lock  -  T"Is integer  (  I  >•  0) 

type  Status  -  (NKCPOata,  Free,  EmptyPage,  ReadOnly,  ReadUrite,  IN,  OUT) 
type  PageFrameName,  PageSlotNama,  SlotAddress,  AddressSpaceOesIgnator 

constant  P0:  PageFrameName  A>  "name"  of  an  NKCP's  page  0  */ 

type  PageFrame  -  structure  of 
(Addr  -  VPage, 

Status  -  (NKCPOata,  Free,  EmptyPage,  ReadOnly,  ReadUrite), 

Av  the  follouing  fields  are  meaningful  only  if  Status  Free  */ 
Ouner  -  ProcessName,  Virtual  Name  ■  PageFrameName, 

TLOCK  -  boolean. 

In  transit  -  (IN.  OUT,  FREE), 

Av  follouing  meaningful  only  if  status  -  ReadOnly  or  ReadUrite  */ 

Rea  I  Key  -  KoylnStorage, 

I  LOCK  •  Lock,  OLOCK  -  Lock,  ULOCK  -  boolean, 

VirtAddr  -  VirtualPage,  Contents  •  PageOfBytes), 

PageSlot  -  structure  of 
(Addr  ■  SiotAddrese, 

Statue  -  T" (Free,  EmptyPage,  ReadOnly,  ReadUrite), 

Av  fcllouing  fields  meaningful  only  if  Statue  *»■  Free  */ 

Ouner  -  ProcessName,  Sname  -  PageSlotName, 

Av  follouing  field  meaningful 

only  if  Status  •  ReadOnly  or  ReadUrite  */ 

Contents  -  PageOfBytes), 

Vir tualPageName  -  structure  of 
(VMname  -  Vir tualflachineName, 

A  -  AddressSpaceOesIgnator, 

Vaddr  -  VPage), 

VirtualPage  -  structure  of 

(Status  -  T" (ReadOnly,  ReadUrite,  EmptyPage), 

Av  follouing  fields  meaningful  only  if  Statue  EmptyPage  */ 


7 


21  Flay  1378  System  Development  Corporation 

2.3  Paging  Parameters  171-6062/1 01/00 


VS  lot  ■  PageS I otName, 

SavedKey  ■  KeyinStorage.  Refer  ■  boolean,  Change  ■  boolean. 

Contents  ■  PageOfBytes, 

Valid  -  boolean, 

/ *v  following  meaningful  only  If  Valid  •  true  */ 

Raddr  ■  VPage  A>  real  page  frame,  if  any  v»/, 

VaddrLIst  -  set  of  Virtue  I PageName  ) 

variable  Rea  I  Address (ASpace,  VPage) t  PageTableEntry, 

VirtPage(ASpace,  VPage) t  VirtualPage 

variable  SharedSegmentListi  set  of  PageTable, 

RealPagesi  sot  of  PageFrame, 

RealSIots;  set  of  PageSlot 

invariant  A"P1,P2:  PageFrame  (PlcRealPages  &  P2<«RealPages 

->  (Pl.Vir tAddr.Val Id  ->  PI. VirtAddr. Raddr  ■  Pl.Addr) 

4  ((Pl.Addr  •  P2.Addr  I 

PI. Owner  -  P2. Owner  &  Pl.YirtualName  ■  P2.VlrtualName 
4  PI. Status  Frue  4  P2. Status  Free 
I  PI.  VirtAddr.  Val  Id  4  P2.Vir  tAddr.Val  id  4  ENV<  Virtu*  I  PageName 
(V<iPl. VirtAddr. VaddrLIst  4 
V<jP2. VirtAddr. VaddrLi at)) 

->  PI  -  P2) ) 

4  S1.S2:  PageSlot  (SlcRealStots  4  S2<iRealStots 
4  (Sl.Addr  ■  S2.Addr 

I  SI. Status  Free  4  S2. Statue  Free 

4  SI. Owner  •  S2. Owner  4  Sl.Sname  •  S2.Sname) 

->  SI  «  S2) 
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2.4s  Legality  Checking  Macros 


This  section  defines  several  macros  which  are  heavily  utilized 
throughout  the  remainder  of  the  kernel  specification  (ail  of 
Chapter  two). 


macro  CheckVfKRs  KProcBlok,  Vs  Virtual  Mach  insName) 

V  -  SYSTEM 

I  LET"K  -  U"Ks  KVMblock  (K<sKVMtable  &  K.VMnume  -  V) 

3  K. Owner  ■  R. Pr ocName 

macro  CheckASpace (R:  KProcBlok, 

Vs  Virtual  Mach  ineNarie, 

As  AddreasSpaceOeslgnator)  ■■ 

CheckVM(R.V) 

3  LET"AS  •  (V  •  SYSTEM  ■>  R. AddressSpace 
<>  AddressSpace (K,  A)  ) 

&  AS. Exists 

define  CheckVPage(S:  ASpace,  Ps  VPage)  ■■ 

S.Exists  &  P  <  S.NumberOfPages 

macro  CheckMPage (Rs  KProcBlok, 

Vs  Virtual  Mach ineName, 

As  AddressSpaceOesignator, 

Ps  VPage)  -« 

CheckASpace  (R,  V,  A)  3  CheckVPage(AS,  P) 

macro  CheckFrame (Rs  KProcBlok,  Pframes  PageFrameName) 

LET"PF  «  LTPsPageFrame  (P. Owner  -  R.ProcName  3  P. Vir tualName  ■  Pframe) 

macro  CheckS lot  (Rs  KProcBlok,  Slots  PageSlotName) 

LET"PS  -  ITSsPageSlot  (S. Owner  ■  R.ProcName  3  S.SName  ■  Slot) 
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2.5i  Address  Space  Definitions 
and  Functions 


This  section  describes  virtual  address  spaces  and  the  functions 
that  create  and  destroy  them. 


/ft  Address  Space  Definitions  ft/ 
type  ASpace  -  structure  of 

(  /*  first  two  fields  uniquely  Identify  this  ASpace  ft/ 

A  -  AddressSpaceOes I gnator,  Owner  ■  Subject, 

Exists  -  boolean, 

/ft  the  following  are  meaningless  if  ^Exists  ft/ 

PurgeTLBNeeded  ■  boolean, 

NumberOf Pages  «  VPage, 

Addresses  ■  T"S:STEList  (C'S  >  0  &  C"S  <•  lSftl 824/SegmentS lie) ) 

variable  AddressSpace  (KVflb  lock,  AddressSpaceOes I gnetor ) :  ASpace 

variable  Spaces:  set  of  ASpace 

conetant  Nul ISpace(AS:AddressSpace):boolean  ■» 

A"  S:SegmentTableEntry,  P:PageTableEntry 

(Sc  AS  ->  ~S.2  I  (PcS.l  ->  4=. 2)  ) 

4  A"i:VPage  (i  <  A.  Number  Of  Pages  ->  V  irtPags  (AS,  i )  .Status  -  EmptyPaga) 

invariant  A"S1,  S2:  ASpace,  K:KVf1block,  A: AddressSpaceOes i gnator,  P:  KProcBlok 
(Sic Spaces  4  S2<: Spaces 

&  KcKVfltable  4  PcProcesssLi st 
->  SI. Exists  4  S2. Exists 

4  (SI. Owner  •  S2. Owner  4  SI. A  -  S2.A  ->  SI  •  S2) 

4  (P. AddressSpace  *  SI  »>  SI. A  »  0 
4  SI. Owner  ■  P.ProcessName 
<>  AddressSpace (K, A)  -  SI 

->  SI. A  -  A  4  SI. Owner  »  K.VMname) 

4  EMKli  KVflb  lock, 

PI:  KProcBlok,  Al:  AddressSpaceOes i gnator 
(PI. AddressSpace  *  SI  I 
AddressSpace (K1,A1)  »  SI ) ) 
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transform  CreateAddressSpace  (Vflt  Virtue  I flachineName, 

S i set  VPage, 

At  AddressSpacsOesignator, 

Rt  KProcBlok) 

refcond  R<tProcessli at  4  R.Proctupe  ■  NKCP 
4  vn  SYS  TEN  4  Check  Vf1{R,  Vfl) 

4  *«AddressSpace(K,  A).  Exists 

effect  (  AreaOKfR. Pr ocName,  (SegmentTableHeaderSi2e  + 

RoundSegments(Size)  it 

(SegmentTab I eEntrySi za 

+  PageTableSize  +  SuapTableSl ze) ) ) 

»>  ReturnCoda(R,0) 

4  E"S:ASpace  (N"AddressSpace (K, A)  ■  S  4 
NullSpace(S)  4  S. Number Of Pages  «  Size 
4  N"Spaces  ■  Spaces  1 1  S" (S) 

4  Ad justQuotafR.ProcName. 

SegmentTab I eHeaderS I ze 

+■  RoundSegments(Size)  it 

(SegmentTab I eEntryS i ze 

+  PageTableSize  +  SuapTableSize)  )  ) 
<>  ReturnCode (R, 1)  4  N"Spacea  -  Spaces 

4  N"K  -  K  4  AdjuetQuota(H.PracName,0)  ) 
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transform  Destroy  AddressSpace (Vfli  VirtualflachlneName, 

Aj  AddresaSpaceDesignator, 

R:  KP-ocBlok) 

refcond  RcPrc  'oslist  &  R.ProcType  -  NKCP 
&  ChecN.i9pace(R,  Vf1,A) 

&  Nul ISpace (AS) 

effect  N"Spaces  -  Spaces  ~~S"(AS)  &  4TAS.EkI sts 

&  Ad justQuota (R. ProcName,  -(SegmentTableHeaderSi2e  + 
RoundSsgments(Size)>v 

(Segmen tTab  I  eEn tryS i  ze+PageTab I  eS i  ze+SuupTab  I  eS  i  ze) ) ) 


•  ?7#r’  'y\  Sr* 
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2.S:  Create/Destroy  Process 


This  section  describes  KVH’s  definition  of  a  process  and  the 
functlono  that  create  and  destroy  processes. 


type  ProcessName  -  Class, 

KProcBlok  »  structure  of 
(ProcName  ■  ProcessName, 

Proctype  -  (NKCP,  TRUSTED,  AUOITED) , 

MessageQueue  -  list  of  MsgBlok, 

flessagePending  «  boolean,  NessagePendingRecei ved  ■  boolean, 
lOInterrupts  -  set  of  JOintBlok,  IQlnterruptPending  ■  boolean, 

C I ockComp I n ter rup tPend i ng  -  boolean. 

Track i ngQuan turn  ■  boolean, 

QuantumGnded  -  boolean, 

CPUT imer In  ter rup tPend ing  •  boolean, 

Rema i n i ngQuan turn  <*  S i gnedOoub I euord,  CPUtimer  »  SignedOoubleuord, 
IntvITimer  *  integer,  Intvl TimerlnterruptPending  -  boolean. 
Internals  -  IntState, 

AddressSpace  ■  ASpace) 

variable  ProcessList:  set  of  KProcBlok 
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transform  CreateProcess  (Asize, 

Csize:  VPage, 

Code:  list  of  PageFrameNams, 

Page0:  PageFrameName, 

Process:  ProcessName, 

R:  KProcdlok) 

refcond  R.ProcName  »  INITIATOR  4 

ProcessCount  <  HaxProcessCount  /*  integer  constant  */ 

4  CSizc  <  ASize  4  CSize  ■  C"Code 

4  A" I :  VPage  (  I  <-  CSize  ->  El''PF:PageFrame  (PF. Owner  -  INITIATOR 

4  PF. Virtual Name  • 

(CodejPageB) . (1+1)  ) 

4  El"PF:PageFrame  (PF.Ouner  -  INITIATOR 

4  PF. Virtual  Name  ■  (CcdetPageB) . (1+1) 

4  PF. Status  -  (I«0  ■>  EmptyPage 
<>  ReadUr i te) ) ) 

effect  (  -vS  I  o  t  cOK  (AS  i  ze-CS  i  ze)  ■>  ReturnCode(R.l) 

4  N"ProcessLi st  -  ProcessList  4  N"Spaces  -  Spaces 
4  A"PF:PageFrame  <N"PF  -  PF) 

<>  ~AreaOK ( IN! TIATOR,  (KProcBlokSize  +  ASpaceSize (ASize) )  )  ■> 
ReturnCode(R,2) 

&  N"ProcessList  »  ProcessList  4  N"Spaces  -  Spaces 
4  A'TFrPageFrame  (N"PF  -  FF) 

<>  ReturnCode (R, 0)  4  AdjustQuotadNITIATOR.KProcBlokSize 
„  „  +  ASpaceSize (ASize)) 

4  E' P:KProcOlok,  SsASpace.  PF:PageFrame  (N''Spaces  -  Spaces  ft  S”  (S) 
4  3. NumberOf Pages  »  Asize 

4  N"ProcessL i st  «  ProcessList  II  S" IP)  4  P.ProcName  ■  Process 
4  PF.Ouner  ■  INITIATOR  4  PF. Virtual  Name  ■  Page0 
4  N" PF.Ouner  -  Process 

4  N'TF. VirtualName  ■  P0  /*  PageFrameNams  Constant  */ 

4  P. AddressSpace  ■  S  4  NoInterruptsPending(P) 

4  S. PurgeTLBneeded 

4  A"l:VPage  (  (I<-CSize  ->  RealAddressIS. I ) .2 
4  E"PF:PageFrame 

(PF.Ouner  *  Initiator  4  PF, VirtualName  -  (Code;Page0) . (1+1) 

4  PF.Addr  ■  Rea  I  Address (S, I ). 1  ) 

4  (I  >  CSize  4  I  <  ASize  -> 

--Rea  I  Address  (S, I ) .2) )) ) ) 
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2.6  Oeata/Oestroy  Procass 


System  Development  Corporation 
TP6-80G2/1 01/00 


transform  DestroyProcess (Prccessi  ProcessName, 

R:  KProcBlok) 

refcond  R.ProcName  -  INITIATOR  4  RcProcessL  i  at 

4  LET"P  -  U"P:  KProcBlok  (P<s  Process!- i  st  4  P.ProcNsme  •  Process) 
4  A"0:  lODevicelGrantedAccessIP.ProcName,  D. Address)  •  Nona) 

4  A"H:f1/niDi  skName  (GrantedAccess  (P.  ProcNa.ne,  fl)  »  None) 

4  A"Sf SharedSegmentName  (GrantedAccess (P.ProcName,  S)  »  None) 

effect  E"SiASpace  IScSpaces  4  P.AddressSpace  ■  S 

4  (  A"ItVPage  (I  <  S.NumberOf Pages 

4  RealAddressIS, I) .2  ->  A”PFi  PageFrame 
(PF.Addr  ■  ReafAddress (S, I ) .1  -> 

PF. Status  •  Readonly)) 

»>  N”Spaces  *  Spaces  SB  (S) 

4  NMProcessList  •  ProcessList  S"  (P) 

4  ReturnCodslR.B) 

4  Ad justQuota ( INI TIATOR,  -  (KProcB I okS i xe 
+ASpaceSize(S.NumberOf Pages)))  ) 

<>  ReturnCode (R, 1)  ) 


IS 
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2.7  Create/0o3troy  Vfl 


2.7:  Craate/Oestroy  VH 


This  section  describes  KVM’s  virtual  machines  and  the  functions 
that  create  and  destroy  them. 


type  VirtualhachineName, 

KVMblock  «  structure  of 

(Vriname  ■  Vjr tualflachineName,  Owner  ■  ProcessName) 

constant  SYSTEM:  Virtual  Mach ineName 
variable  KVflTable:  set  of  KVflblock 


Sustain  Development  Corporation 

Tfl-6082/1 01/00 
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2.7  Create/Destroy  vn 


transform  CreateVWVN:  Virtual NachineName, 

NCKPNamai  ProceesName, 

Rs  KProcBlok) 

rafcond  R.ProcName  •  INITIATOR 

4  El " P :  KProcBlok  (PcProceesList  4  P.ProcName  ■  NKCPName 

4  P.ProcType  ■  NKCP) 

effect  (  EMK:KVnblock  (K<«KVntable  4  K.vnName  -  VH) 

■>  ReturnCode<R,l) 

<>  A"K:KVHbl ock  (KoKVntable  ->  K.vnName  —  Vtt) 

->  El"KsKVnblock  (K.vnName  -  vn  4  K.Duner  -  NKCPName 
4  A"A:Addres3SpaceQesignator ( 

«.AddressSpace (K,A) . E:c I <*ta  ) 

4  N“KVnTable  «  KVnTable  II  S"(K)  )  ) 


Sustain  Dsvslwpment  Corporation 
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2.7  Create/Pestroy  VH 


transform  OestroyVfl  (Vfl* Virtual flachineNome, 

Rs  KPr ocfi I  ok) 

rafcond  LET"K  -  U"K:  KVflblock  (KoKVtttabte  £  K.VMName  -  Vfl) 

&  A"A: AddressSpaceDeaignator  (Nu 1 I spacelAddraaeSpacelK, A) )) 
£  (R.ProcName  -  INITIATOR  I  R.ProcName  •  K.uwr,ar) 

effect  N"KVf1table  -  KvntabI*  <~  S"  OO 
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2.8  Grant/Revoke  Functions 


2.3:  Grant/Revoke  Functions 


This  section  describes  real  10  devices  and  shared  (meeory) 
segments,  and  defines  the  functions  that  grant  and  revoke  aceese 
to  them. 


type  HeaciNumber  -  T"H:  integer  (H  >■  0  4  H  <•  50) , 

Cy I  inderNumber  *  T"C: integer  (C  >■  0  4  C  <»  10000), 

type  ObjcctName  -  structure  of 

IKindCfObject  »  (SharedSegment,  Hor  izontaWinidlek, 

Vert i ca (Minidisk.  UholeOevice), 

/» v  Pages  meaningful  only  if  KindOfObject  ■  SharedSegment, 

Voi  only  if  KindQfObject  *«  Horizontal  or  Vertiealllinldltk 
Slice  only  if  KindOfObject  «  Horizontallllnldl  sk. 

Start  and  Finis  only  if  KindOfObject  »  Vert icalHInidi sk, 
Oev  only  if  KindOfObject  ■  UholeOevice  */ 

Pages  -  list  of  PageFramaName, 

Vol  ■  RoalVolumeJd, 

Slice  -  HeaciNumber , 

Start  ■  Gy  I inderNumber, 

Finis  «  Cy I i nderNumber , 

Dev  -OeviceAddress) 
constant  NullOevice:  OevicsAddrsst 
type  OunedVolume  -  structure  of 
(Name  -  RealVolumeld, 

Device  *  DeviceAddraas) 

variable  OunedList:  set  of  OunedVolume, 

DeviceUist;  set  of  RealDevice, 

SharedVolumeOevices:  set  of  OeviceAddress 

e 

constant  Dev type (Un i t Type) j  OsviceOtscr iption 

define  DeviceExI sts(D:  OeviceAddress)  »■  LET"0v  «  UH0v:  RealDevice 
(Ov.Addr  »  0  4  OvcOeviceList) , 

VolumeflountedfV:  Real VOlumeld)  •• 

LET  "VOL  -  !J"  VOL:  OwnedVo  turns  ( 

VOL.Nams  *  V  1  VQLo OunsdL ist) 

4  VOL. Oe vice  NoOevico 
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2.8  Grai.t/Ryvoke  Functions 


System  Development 
Tfl 


type  Grant  »  structure  of 

(Access  -  set  of  (Readonly,  ReadUrlte), 

Class  -  (DASO,  Terminal,  Tape,  UnitRecord), 
Oed i cats  »  boolean, 

/*  following  meaningful  only  if  Class  ■  DASO. 
Tracks  meaningful  only  if  Horizontal  ■ 
Cyls  only  if  Vertical  -  true 
Horizontal  ■  boolean. 

Vertical  ■  boolean. 

Tracks  ■  set  of  NeadNumber  ><  Access, 

Cyls  •  set  of  Cyl inderNumber  ><  Access  ) 

constant  NoAccessj  Grant 


Corporation 
■6062/1 01/00 


true, 
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2.8  Grant /Revoke  Function* 


Sustain  Oavalopnant  Corporation 
Ttl-6082/101/00 


transform  GrantAecesalOb iectt  ObJactNama, 

Acet  (Readonly,  ReadUrite), 

.it  k’ProcBlok) 

rafcond  TRUSTED (R.ProcNAflE)  8  RoProcossLiat  8  P<»Proc***U*t 
8  (Ob Joct. KindOfObject  •  SharedSegmsnt  ■> 

R.ProcNama  ■  INITIATOR 
8  C"0bject. Pages  •  PageePerSegment 
8  AnPframat  PagaFramaNama  (PframaoObJact.Pagaa 
-»  ChackFra«a(R,  Pframe) 

8  PF,Statu*<j (Readonly,  RaadWr I ta)) 

<>  Ob ject. KindOfObject  ■  Horlzontallllnldlek  ■> 

Volumoflounted  (Object.  Vol ) 

8  Vol. Name  «  Object. Vol  8  Vol. Division  -  Horizontal 
8  SI  ice  >■  0  ^ 

8  slice  <  OavtypalV.DavIcaTypa) .TrackeParCyl  Indar 
<>  Ob ject.Kindf.fOb jact  ■  Var t Icalttlnldl ak  »> 

Vo  l  umeNour.  ted  (Ob  ject.Vol ) 

8  Vo  1.0 1  vie  ion  ■  Vortical 
8  Start  >•  8  8  Start  <■  Flnla 
8  Finis  <  Oavtype(Vol.Davic*Type).NumCyl 
<>  Ob  ject.KIndOfObjaet  ■  Uho'eOevIce  •> 

OsvicaExiatatObjact.Dev) 

8  Object. Dev  «.<tSharedVolumeO*vlcaa  ) 

affect  (Object. KindOfObject  -  SharedSegmant  •>  ElHPTi  PagaTable 

(PT< j  N H Shar adSegmen tL I  St 

8  A" I i  Integer  (I  >  0  8  i  <•  PageePerSegment 
->  CheckFrame(R,  Object. Pages. I) 

8  PT. I  -  PF) 

8  PT<jN"SharedSogmentLlst(P) 

8  FT. Name  »  Object. Name) 

<>  Ob ject. KindOfObject  «■  UholeOavice  ■> 

LETUG  *  GrantedAccees(P.ProcName,  Object  Qev) 

8  N"G. Access  •  C.Argeas  II  S"(Acc) 

8  N"G.Oodicate  •  true 

8  N"G. Class  ■  0ev!c*Type(0b ject. Dev) .Class 
<>  Vo lumcNotinted (Ob  ject. Vol ) 

8  LET"G  ■  GrantedAcressIP.ProcName,  VOL. Device) 

8  N'G.Accdss  «  G.rtccess  II  S" (Acc) 

8  N"G.Cioea  -  OASD  8  ~N"G. Dedicate 
8  (Ob ject.KIrcCfOb Ject  -  Hor IzontalHInidlek  -> 

N"G. Horizontal  8  «^JHG. Vertical 
8  N"G. Tracks  ■  G. Tracks  II  S" (Object. SI  lea,  Acc) 

Ob  ject. KindOfObject  ■  Vert  icalflinldlsk  ■> 

NMG. Vertical  8  «N"G.Hor Izontal 
8  N"G.Cyls  «  G.Cyls  1 1 

SHZt  Cy I Tr.der Number  ><  (ReadOnlu,  ReadUrite) 
(Z.i  >»  Start  8  Z.I  <“  rlnla 
8  Z.2  -  Acc)  )) 
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2.8  Grant/R*voko  Function* 


Sy*t*i»  Development  Corporatl 
Ttl-8062/181/ 


tr  ant  form  R*l*as*D*vie*(Qevicet  0*vlc*Addre*a. 

P. 

R»  KProeBlok) 

rafcond  R.ProeTypo  •  Tnuatad 

4  GrantcdAcceo*  tP.ProcNa**,  Oevlce)  *•  NoAcc*** 

4  A  LBi  LockodBox  (LB<iLock*dBoxLI*t 

4  LB. Notify  ■  P.ProcNam*  ->  IB.Oev  «. 

•ff*ct  N"Gr*nt*dAcc***(P.ProcN*»i*,  Otvlc*)  ■  NoAcc*** 


S 
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2.9  Attaeh/Detaeh  Page  Functions  Tfl-6062/101/00 


2.3»  Attach/Oetach  Page  Functlone 


This  eection  defines  the  functions  which  place  and  remove  virtual 
pages  In  virtual  address  spaces. 


transform  At tachPage (Pframei  PageFrameName, 

Addrj  V l r tua I PageNama 
Ri  KProcBlok) 

refeond  ChcckFramefR.  Pframe) 

8  CheckMPagclR,  Addr. Vflname,  Addr.A,  Addr.Vaddr) 

8  LET  VP  -  VirtPage(A.Addr.Vaddr)  8  .ET  Ad  ■  Rea  I  Addr  see  (A,  Addr.Vaddr) 

8  PF.ILOCK*  0  8  PF. Statuses*  (EmptyPage, ReadWr I  te) 

8  (Ad. 2  ->  U"P:  PagcFrame  (P.Addr  »  Ad. 1). Status  ■  ReadUrite) 

effect  N"Ad,l  -  PF.Addr  8  N"Ad.2 

8  N"PF. Status  -  ReadUrite  8  N"PF.TLQCK 
8  N"PF.RealKay.Kay  ■  (VP. Status  •  EmptyPage  ■>  KeyB 

<>  VP.SavedKoy.Key) 

8  N"PF.  Real  Key.  NoFetch  «  (VP.SavedKey.NoFeteh  8  VP. Statue  EmptuPaga) 

8  (PF.VirtAddr. Valid  ->  ~N,,PF.RaalKay.Refar  8  4T  PF .  Rea  I  Key .  Change 
8  «.N"VP. Change  8  *N"VP.Refer  ) 

8  N"VP. Status  •  ReadUrite 

8  Ad. 2  ->  N"A.PurgeTLBNeeded 

8  PF.Statu3  ■«  EmptyPage  ->  NMPF, Contents  »  0 

8  N"PF.Vir  tAddr  -  N"VP  8  N"VP. Vaddrtl et  -  VP.VeddrLIet  II  S"  (Addr) 

8N" VP. Valid 
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2.18  Swapping  Function*  TM-6862/1 81/08 


2.10s  Swapping  Function* 


This  auction  d**crib«a  th*  functlona  ov*ra**lng  tha  movement  of 
r*al  pag«*  b*tw**n  real  memory  ar.«  d!rect-aee*s*  storage  devices. 
Th*  system  protacta  against  mla-**v?ke  by  associating  a  kay  with 
•ach  r*cord  on  a  disk  trjck.  This  kay  is  an  encrypted  addrasa  of 
th*  racord.  After  locrtinn  th*  record  (via  SEARCHlu),  th*  kay  la 
verified  to  be  tha  particular  one  daairad  ( *  i  a  5EARCHKEY) .  The 
kay  is  not  visible  to  th*  usar  nor  to  untrustod  control  software. 

EnqueueSwap  is  not  described  in  tha  preliminary  design 
documentation  provided  in  Tfl-5855/288/08.  This  function  Is  a 
common  routine  used  by  Swapln  and  SwapQut.  It  enters  swap 
requests  Into  the  queue  of  outstanding  10  rsquasts. 


type  SearehTupe  <  CCUObCode,  SlotKey, 

SwapCheck  ■  SearchTyp*  ><  SlotKey  ><  Integer, 

SwapBlok  »  structure  of 

(ReqType  -  (IN,  OUT), 

Active  •  boolean. 

Frame  «  VPage, 

Slot  -  SlotAddresa, 

Notify  »  ProcesaName, 

10  *  RaqueetName, 

Check  •  SwapCheck). 

SwapReq  *  list  of  SwapBlok 

constant  C I  ear, Nochccks: SwapCheck,  Nu 1 1 Suapj  SwapBlok 

RecNum (SlotAddresa) ,  TrackAddress(SlotAddrass)t  integer 

variable  SwapQucue:  set  of  SuapRaq 

Invariant  A"SR:  SwapRoq  ( (SRcSwapGueue 

->  A"Bi  SwapBlok  (BcSR  ->  B.Slot.l  ■  SR. 1. Slot. 1) ) 
&  A"T:  SuapReq  (T<* SuapQueue 

&  T.l.Slot.l  -  SR. 1. Slot. 1  ->  T  -  SR)) 
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pp ing  Function* 


Suited  Development  Corpdrit Ton 
TH-6062/1 01/00 


transform  EnqueueSuapiPFi  PageFrame, 

0 1 rec  t 1 on«  h ( IN, OUT) 

Slott  PagaSlot, 

.  Chkt  SuapGhaeK,  . 

. .  '  NotIfyrKPl'OCBlok, 

lOi  PaquistNams) 

refcond  PF. ILOCK  -  0  4  PF.OIOCK  *  0  4  -PF.UL0CK 
4  PF.  Intransi  tcS"  (Free, Direction) 

effect  (Direction  -  OUT  ->  SetSlot(PF,Slot)  ) 

4  N"PF. Intranai t  ■  Direction 

4  E"SR:  SuopReg,  Bt  SuapBlok  (Be SR  4  SR  < :  N " SuapQueue 
4  B.ReqType  -  Direction 
&  B. Frame  •  PF.Addr  4  B.Siot  •  Siot.Addr 
&  B. Check  •  Chk 

4  B. Notify  •  Not  I fy.ProcName  4  B.ID  -  ID) 

Av  future  SNAP  Daemon  effect 

A"  SR:  SuapReq,  B:  SuapB  l  ok  (SR<:N"SuapQueue  4  Be  SR 

->  (B.ID  '«•  ID  I  B.Notlfuw-  Notify. ProcName)  ) 
4  (Direction  «  OUT  ->  N"Slot, Contents  •  rF. Contents 
<>  Direction  -IN  ->  N"PF. Contents  -  Slot.Contents) 

4  N"PF. Intranei t  -  Free 
4  N"Noti fy. IOlnterruptPending 

4  E"I:  IOintBlok  (I<:N"Noti fy. lOinterrupts  4  I. ID  -  ID) 

4  (Direction  -  OUT  ->  N"Slot 

<>  N"PF) .Status  -  ReadUrlte 
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2.10  Swopping  Functions  Tfl-6062/1 01  /00 


transform  SwapOut  IP frame:  PageFrameNeme, 

ID:  RequestName,  . .  ■ 

R:  KProcBlok) 

ref cond  R<iProceesl.i st  4  CheckFramelR.Pframe) 

4  PF. Statuses"  (ReadOnly^ReadWri  te) 

effect  E"PS:PageS lot  (PS. Status  ■  Free  4  EnqueueSwapIPF,  OUT,  PS. 

(RecNum (PS.Addr)  »  1  ■>  (SearchHAEq,  PS.Addr,  l) 

<>  (SearchKeyEQ,  U"PSl«  PageS lot 
(PS1<: ReadS lots 
4  TrackAddr (PSl.Addr)  ■  TrackAddr (PS.Addr) 
4  RecNum(PSl.Addr)  ■ 

RecNum (PS.Addr)-l) .Key, 

81), 

R.  10)  ) 
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2.10  Suapplng  Functions 


transform  SwapInIPframe:  PageFramsName. 

Slot:  PageSlotName, 

10:  RequestName, 

R:  KprocBlok) 

refcond  RcProcessList  &  CheckFrama (R,  Pframe)  8  CheckS I ot(R,  Slot) 

&  PS. Status  »  ReadUrite  &  PF. StatuscS"  (EmptyPage,ReadWr  i  ta) 

effect  EnqueueSuapIPF,  IN,  PS, 

(SearchKeyEQ,  PS. Key,  8), 

R,  ID) 
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2.11  Status  Page  Function 


System  Development  Corporation 
1(1-6062/101/00 


( 


2. 11<  Status  Page  Function 


This  section  contains  the  single  function  StatusPage,  which 
returns  status  information  about  a  virtual  page  to  the  NKCP  owning 
the  page. 


transform  StatJsPageCVpage:  YirtualPageName  /it  VtIName  +  Page  Number  */  , 

Ri  KProcBlok) 

refcond  CheckfIPage  (R,  VPage. Vflname,  VPage.A,  VPage.Vaddr)  8  RcProceseLi  at 
4  LET "VP  -  VirtPage (AS, Vpage.Vaddr) 

4  LET"Ad  -  Rea  I  Address (AS, Vpage.  Vaddr) 

4  Ad. 2  ->  LET"PF  -  U"PF:  PageFrame  (PF<tRealPages  &  PF.Addr  -  Ad.l) 

effect  (AO. 2  *»>  N"VP. Change  ■  (VP, Change  I  PF. Change) 

&  N"VP. Refer  -  (VP.Refer  I  PF. Refer) 

4  N"Status.HeadWri te  ■  (PF. Status  -  ReadUrite) 

4  N"Status. Present  ■  true 

<>  -AO.  2  «>  -N"Status. Present  4  N!‘Statu3.ReadUr  i  te  -true 
4  N"Status.Slot  ■  VP.VSIot) 

4  N"Status. Refer  •  NMVP. Refer  4  N"Statue. Change  ■  N"VP. Change 
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2.12  Storage  Key  Pune t ions  TH-6062/1 01/00  * 


2.12:  Storage  Key  Functions 


This  section  contains  the  Kerne)  functions  th-.<  t  read  and  write 
storage  Keys  in  virtual  pages. 


transform  SetStorageKey (Vfl:  Vir tualHachineN'ame. 

Page:  VPage, 

Key:  KeylnStorage, 

R:  KProcBioK) 

refcond  R.Proctype  -  NKCP  4  RcProcessLIst  &  ChacKMPage (R,  VII,  0,  Page) 

4  LET "VP  -  Vir tPage(AS.Page) 

&  LET"Ad  ■  Real  Address (AS,  Page)  4  VP. Status  ■  ReadU'ite 
effect  N"VP.SavedKey  ■  Key 

4  (Ad. 2  ->  LET"PF  -  U“PF:  PageFrame  (PF<: Rea  I  Pages  4  PageFrame. Addr  •  Ad.l) 

4  N"PF.RealKey.NoFetch  *  Key.NoFeteh 
4  N"PF.RealKey.Key  -  Key. Key 
4  *N"PF. Rea  I Key. Change 
&  <*N"PF.RealKey.Refer 
4  N"VP. Change  ■ 

(VP. Change  I  PF. Rea  I Key. Change) 

4  N"VP. Refer  -  (VP.Refer  T  PF.RealKey.Refer) 
<>  ~  Ad. 2  »>  N"VP. Change  •  VP. Change  4  N"VP. Refer  »  VP.Refer) 
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2.12  Storage  Key  Functions 


.  System  Development  Corporation 
TM-6062/1 01/00 


transform  ReadS tor ageKey(Vf1:  VlrtualflachineName, 

Page:  0..8191, 

R:  KProcSlok, 

Kay:  KeylnStorage  /ft  output  ft/  ) 

refcond  R.Proctupe  -  NKCP  4  RcProcessList  4  Checkf1Page(R,  Vtl,  0,  Page) 

4  LET"VP  -  VirtPage(AS.Page)  4  LEF'Ad  -  RealAddresstAS,  Page) 

effect  (Ad. 2  ->  LET"PF  •  U"PF:  PageFrame  (PFcRealPages  4  PF.Addr  ■  Ad.l) 

4  N"Key.Key  -  PF. Rea  I Key. Key 
4  NIMKey. Noretch  ■  PF.RaalKey.NoFeteh 
4  N"Key. Change  ■  (PF. Real  Key. Change  I  VPChange) 

4  N"Key. Refer  -  (PF.RealKey. Refer  I  VP. Refer) 

<>  ~Rea I  Address (A, Page) .Val id  ■>  N"Key  ■  VirtPage(A,Page) . SavedKey) 
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2.13  lock/Unlock  Page  Functions  Tfl-6062/101/00 


2.13*  Lock/Unlock  Page  Functions 


This  section  contains  the  kernel  functions  that  manipulate  user 
locks  oh  page  frames. 


transform  LockPege (P frame:  PageFrameName, 

R:  KProcBlok) 

refcond  CheckFraae (R,  Pframe)  8  PF.1L0CK  ■  0  4  ~PF.UL0CK 
effect  N"PF.ULOCK  «  true 
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2.13  LoeK/UnlocK  Page  Function*  Tfl-8062/181/00 

transform  UniockPage (Pframat  PageFraaaNama, 

P»,  <Pr(/cB  I  Ok); 

refcond  CheckFrams (R»  Pframe)  A  PF.ULOCK 
effect  N“PF , ULOCK  -  falae 
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2.14i  Schodu ling  Functions 


This  aoction  contains  tha  kernel  functions  which  oversea  the  basic 
process  scheduling  provided  by  tha  kernel.  ScheduleProceae  la 
invoked  only  by  the  (semi -trusted)  scheduler.  The  function 
schedules  NKCPs  and  trusted  processes.  Once  an  NKCP  le  active.  It 
may  request  tho  remaining  scheduling  operations. 
Recel velnterrupts  and  OispatchVM  are  fairly  clean  the  former  asks 
the  kernel  to  provide  the  NKCP  with  an  outstanding  Interrupt,  if 
one  exists.  ReleaseCPU  signals  the  termination  of  activity  of  the 
process,  and  a  Nous  the  kernel  to  activate  the  next  available 
process.  RcsumcProcess  allows  an  NKCP  to  modify  Its  activity 
status  bits  without  relinquishing  the  CPU  to  another  process.  For 
example,  if  the  NKCP  decides  to  turn  on  monitoring,  it  may  do  so 
by  performing  the  ResumrProcass  kernel  call  with  the  appropriate 
parameters. 


type  InterruptMask  -  structure  of 
(Intv I  Tinier  «  boolean, 
Message  •  boolean, 
ClockComp  ■  boolean, 

CPU  timer  ■  boolean, 

10  •  boolean. 

Quantend  -  boolean) 
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transform  ResumeFrocessINewPSUi  ProgramStatusUord, 

Grsgsi  RsgistarSat. 
flONi  floni  torCl  asaas, 

R«  KProcBlok) 

refcond  R<»Processl_i st 

•  ffsct  N"SYSTEH*-Gr«gs  ■  Gregs 
ft  N"SYSTEM-PSU  -  NewPSU 
ft  N"SYSTEf1‘-Crsg«  - 

(  (K2,  K64),  R. AddressSpace. Addrasses, 

**1.  0.  0,  0. 

(falsa  Alta/,  falsa,  false,  true, 
falsa,  false,  true,  R. Crags,  true), 

0.  MON, 

(false,  false,  false,  false,  0),  0,  0,  0,  0, 

(true,  true,  falsa,  falsa, 
false,  true,  falsa,  'alse,  false),  512) 
ft  N"VMA  -  (R. AddressSpaca. Addresses,  R. Crags,  true,  NeuPSU, 
UorkArea,  0,  0,  8,  0) 


Suitciii  Oeve l opment  Corporation 
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transform  RECEIVE  Interrupts  (fit  InterruptMask, 

Rt  KProeBlok) 

rafeond  R<tProcassU st 

affact  (R. Intvl Timer IntorruptPendlng  8  fl.  IntvITImar 

*>  Si niulatsExternal  Interrupt  (R,  X*80*) 

<>  R.floasaycPending  8  fl.flssaaga  8  *R.f1essagePendlngRaceived 
■>  S i mu  I  a teEx terns  I  Interrupt (R,  X*l202’) 

<>  R.ClockComptlnterruptPendlng  8  fl.ClockComp 

->  S i mu  I ateExterna I  Interrupt (R,  X  1004  ) 

<>  R.CPUTimerlnterruptPending  8  fl.  CPU  timer 

•>  Si  mu  I  ateExterna  I  Interrupt^,  X’1005  ) 

<>  R.  lOlnterrupts  empty  8  fl.  10 

m>  El"Bt lOintBlok  (NMR. lOlnterrupts  -  R. lOlnterrupts  S’  (B) 
8  SlmulatelOIntarrupt (R,  B.ReqType,  B.ld)  ) 

<>  N"R  -  R) 
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2.14  Schadu I iny  Functions  TM-60B2/101/00 


transform  RalaasaCPlMRj  KProcBlok) 
rafcond  R<iProcassList 


affact  N"R. Grays  -  SYSTEM-Grsgs 

4  N"R.M0N  -  SYSTEM-Crags.8 
&  N"R. Intvl Timar  -  SYSTEM-TIMER 
&  N"R.CPUT i mar  -  SYSTEM-CPUTimar 

+  (R. Track ingduantum  ■>  R.CPUTimar  -  R.RamainingQuantum 
<>  0) 

4  E1"P«  KProcBlok  (P<«ProcassLI st  4  N“Raquaster  -  P.ProcNama 

4  RasumaProcosstP.  P.RasumaPsw,  P. Grays,  P.MON) 

4  N" SYSTEM-TIMER  -  P.IntvlTimar 
4  N"SYSTEM-CPUTimar  - 

(P. Track ingQuan turn  ->  P.RamainingQuantum 

<>  P.CPUTimar)  ) 


4  Pur i fySharedSystams 


37 


21  Flay  1978  Systam  Davslopmant  Corporation 

2.14  Schadu 1 1 ng  Functions  TF1-68B2/101/00 


transform  ScheduleProceasFP,  Rj  KProcBlok) 

rafcond  P<tProcs3*L I st  8  R<iProc«aaUat  &  R.ProcNama  ■  SCHEDULER 

affact  N"Requoater  ■  R.ProcNama  8  RasuittaProcass(P,  P.RasumaPaw,  P. Crags,  P.HON) 
8  N"SYSTEM*-TU1ER  -  P.lntvITImar 

8  N"SYSTEHt-CPUTlmer  ■  (P. TracklngQuantum  »>  P.RamalnlngQuantum 

<>  P.CPUTImar) 
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transform  Dl spatchVM(VMnamet  VlrtualMachlnsName, 

A:  AddrossSpaceDeslgnator, 

NeitPsuf  ProgramStatusWord, 

Grogs:  RegisterSet, 

Frags:  FragSat, 

DAT:  DATSpee, 

MON:  Half Mask, 

PER:  PerSpec, 

VMA:  VMASpec.  At  Aaai  atE,  VProbSt,  ISKd, 

370d , SVCd , ShadouE ,  CCPAaatOJ 
TlmerE.Cregs.VIPft/ 

Time:  integer, 

R:  KProcBlok) 

refcond  RcProcessl  I  st  4  R.ProcType  ■  NKCP 

4  Time  >  0  4  Time  <  MaxTimeSliceft300ft256 

effect  N"SYSTEM*-Gregs  -  Gregs  4  N"SYSTEM^rege  •  Frega 
4  N* SYSTEM-TIMER  -  Time 
4  N"SYSTEM»-PSU  -  (NewPsu.ProtectionKey. 

Ne wP  aw . CC ,  NewP  sw .  I LC , 

NeuPsu.ProgMask, 

NeuPsw. InstAddr) 

Av  R,  T.  10,  EXT,  EC,  M,  P  -  1,  14  •  0  ft/ 

4  N"SYSTEM*-Cregs  ■  (  0AT.1,  DAT. 2,  /ft  Page  4  Segment  Size  ft/ 
AddressSpacatK, A) .Addresses,  /ft  CR  1  ft/, 

“1 »  0.  0,  0, 

/ft  VMA  Control  »  VMA  Mask  ><  MICBIokAddreae 
(Furnished  by  Kernel)  ft/ 

(VMA. 1,  VMA. 2,  VMA. 3,  VMA. 4, 

VMA.S,  VMA. 6,  false,  VMA. 7), 

MON.  0, 

/ft  PER  control  •  EventMask,  REgi aterMask,  PerStart,  PerEnd  ft/ 
(PER.l,  PER. 2),  PER. 3,  PER. 4, 

0,  0. 

(true,  true,  false,  false, 

false,  true,  false,  false,  false,  false), 

512) 

/ft  RealSegmentTbl ,  VirtCregs,  VIP,  VirtPSU, 

UorkArsa,  VTimer,  0,  0,  0  ft/ 

4  N "  KERNELS  I CBIOK  •  (AS. Addresses,  VMA. 8. real ,  VMA.S,  NeuPsu,  Uorkaree, 
(•.VMA.  7  ->  0 

<>  PageBPressnt (AS)  •>  Rea  I  Address (AS, 0) +80 
<>  Rea  I  Address (R.AddressSpace,  VMblock) , VMTIMER) , 

0,  0.  0) 

4  CheckASpace (R,  VMname,  A) 
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2.15  Al location  Functions 


2.15:  Al locat ion/Oaal location 
Functions 


This  section  contains  the  kernel  functions  dealing  with  allocation 
and  deal focat Ion  of  page  frames  and  page  slots.  In  KVfl  a  page 
frame  is  an  area  of  real  memory,  and  a  page  slot  is  an  area  on  a 
direct-access  storage  device.  A  page  is  the  contents  of  a  page 
frame  or  a  page  slot. 


transform  FreePageFramelPF:  PageFrame) 

refcond  PF. Statue  *  ReadUrite  8*PF.UL0CK  4  ~PF.TL0CK 

&  PF .  1  LOCK  -  0  4  PF. OLOCK  -  0  4  PF. Intransit  -  Free 

effect  N"PF. Status  -  FREE  4  N"PF.VirtList  -  empty 
S  *N"PF.Vir tAddr. Val id 

4  A  "VPN:  VirtualPagaNameC  VPNcPF.  VirtAddr.VaddrLi  st 

->  CheckASpace (U"Pt  KProcBlok  (P.ProcName  •  PF. Owner) 
VPN.Vflname, 

VPN. A) 

4  N"AS. PurgsTLBNeeded) 
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transform  FreeS I ot (S I ots  PageSlot) 
refcond  Slot. Status  «-c:S"  (Free,  EmptyPage) 
effect  N"Slot. Status  -Free 
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transform  ReleaseSlot (Slot:  PageSlot, 

R:  KPr ocfiloK) 

refcond  RcProcesslI  st  &  R.ProcNameoS’'  (SCHEDULER,  INITIATOR) 
effect  FreeSlot(Slot) 
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System  Development  Corporation 
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constant  I nser tSuap (L:  list  of  SuapBlok, 
AFTER:  SuapBlok, 

NEU :  SuapOlok) 

(L. .1  -  AFTER  ->  L  ; .  NEU 

<>  InsertSuapd.  tt.2.  AFTER, 


NEU}:.  L..1) 
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transform  ChalnPagelOfSRt  SwapRaq, 

New:  SuapBlok, 

Uhara:  SwapBlok, 

R:  KProcBlok) 

refcond  RcProcessU  st  &  R.PrccName  ■  SCHEDULER 

5  SR<: SuapQueue  6  UherscSR  &  ~SR. Active 

6  New. Slot. 1  -  Uhara. Slot. 1 


effect  N"SR  ■  Inser tSwapiSR,  Uhara,  New) 
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transform  Re  leasePage (Page:  Virtual  PageName, 

R:  KProcBlok) 

refcond  R<:Proce3sU  st  8  CheckASpaeetR,  Page.  Vflname,  Page. A) 

&  LET  "VP  .  VirtPage(AS,  Page.Vaddr)  8  VP. Statue  EmptyPage 

effect  N"VP.Statu3  «•  EmptyPage 

&  (VP, Vaiid  ->  FreePageFrame (U"PF :  PageFrame  (PF.Addr  ■  VP.Raddr)  ) 
<>  FreeSlot (U"PSi  PageSlot(  PS.Sname  -  VP. VS  lot 

4  PS. Owner  -  R.ProcName)  )  ) 
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transform  SetSlotIPF:  PageFr«?me, 

Slots  PageS I ov) 

refcond  PF.Status<sS" (RoadUr I ts,  ReadOnlu)  8  PF.lntraneit  IN 
8  PF.  I  LOCK  -  0  8  PF.  CLOCK  -  0  &  -PF.ULOCK 
8  PS. Status  ■  Free 

effect  N"S!ot. Status  -  EmpiuPage 

8  N"Slot. Owner  -  PF. Owner  8  N"Slot.Sname  -  PF.VirtAddr.VaddrLlst.l 
8  NMPF. VirtAddr. VSIot  -  NHSlot.Sname 
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( 

transform  AssignSlot (PF t  PageFrame, 

Slots  PageS lot, 

R:  KProcBlok) 

refcond  RoProcessti  st  &  R.ProcName  -  SCHEDULER 
effect  SetSlot(PF,  Slot) 


/ 

v 
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transform  StealPagcFrama(PF:  PageFrame, 

10:  RequestName, 

Noti  fy, 

R«  KProcBlok) 

refcond  J^ProcesaLlat  4  R.ProcName  -  SCHEDULER 

i  S:?asr.-,?rstiScJ  ^•ulock  4  'pf'tlock 

4  PF.  Intransi  t  IN 

effect  FreePageFramo (PF) 

&  (PF.VirtAddr. Change  -> 

R"PS:  PageS lot (PS. Status  -  Free 

4  EnqueueSuaptPF,  OUT,  PS.  Notify,  ID)  )  ) 
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transform  GetPageFrama ( lOt  RequastName, 

R»  KProcBlok, 

Pframat  PageFramsName) 


refcond  RcProcessLIst 

effect  N"Pframe  -  R.GetPagaCount  8  N"R.GetPageCount  -  R.GatPagaCount  +  1 
8  (E"PFi  PagaFrame  (PF. Status  «  Free)  »> 

El"PFi  PagaFrame  (N"PF.0uner  ■  R.ProcNama 
8  NHPF. Virtual  Name  -  N"Pframe 
8  N"PF. Status  •  EmptyPage) 

8  N"R. lOlnts^rupts  -  R. JQIntsrrupts  II  S"(ID) 

4  N"R. lOIntsrruptPsnding 

<>  E"PF:  PagaFrame  (PF. Status  •  RsadWrlts  8  -PF.ULOCK  8  -PF.TLOCK 
8  PF. I  LOCK  -  0  8  PF.OLOCK  -  0) 

->  StealPagaFrams(PF,  10,  R, 

U"r i  KProcBlok  (P.ProcName  •  SCHEDULER 
8  PcProcessLIst)  )  ) 

8  (C"S”PFi  PagaFrame  (PF. Status  •  Fraa)  <  HinFreePagea 
8  E"PFi  PageFrama  (Stealable(PF)  ) 

■>  E"PF: PagaFrame (Stea lab  I  a (PF)  8  Stea IPageFrame(PF,  8,0, 

UMP*  KProcBlok  (P.ProcNatna  -  SCHEDULER 
8  PcProcassLIst)))) 
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2.16»  Spool ing  Functi one 


This  section  contains  the  kernel  functions  that  support  spooling 
using  virtual  spool  cylinder  addresses.  AN  requests  for  spool- 
type  10  are  mapped  from  virtual  to  real  addresees  and.  If 
necessary,  delayed  until  the  required  real  object  becomee 
aval  table. 


type  SlotNumber  <  integer, 

SpoolCy lAddress  ■  RsalVolumeld  ><  Cy I inderNumber, 
SpoolS lotAddress  -  SpoolCy lAddress  ><  SlotNumber, 
RraISjoolCyl  =»  structure  of 
(Exists  ■  boolean, 

Addr  «  SpoolCy lAddress, 

Status  «  (Free,  EmptyPage,  InUse) ) 

variable  Rea  I Cy I (Spool Cy I Address ) i  Rea I SpoolCy I , 
RoalSpoolCyl indersiset  of  RealSpoolCyl 
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transform  RequestSpool 10(0irect!cm  UN, OUT), 

Sloti  SpooiSlotAddrass, 

10:  RequestName, 

Paget  VPage, 

R:  KProcBlok) 

refcond  RcProccasL  I  ct  4  R.ProcType  *  NKCP 
4  Check VPagc(R. AddreasSpaca,  Page) 

4  LET”RA  *  RealAddresstR.AddresaSpace,  Page) 

4  RA.2  4  LET"PF  .  UHPFtPageFrame  (PF.Addr  -  RA.l  4  PFcRaelPagee) 

4  PF. Intransl t  -  Frae 
4  (Direction  »  IN  ■>  PF. CLOCK  ■  0 

4  PF. StatuecS"  (ReadUr  I  te,  EmptyPage) 

I  RaalCyl IR,  Slot. 1) .Exists 
<>  PF. ILOCK  ■  0  4  PF. Statue  ■  ReadUrite) 

effect  iRealCyl  (R,  Slot. 1). Exists  ■>  N"RealCyl (R.Slot.l)  »  RealCyl (R.SIot.l) 
<>  E"C:  RealSpoolCyl inder  (Status(C)  ■  Free 

4  C<: Rea  I  Spool Cylinder s 
4  NHStatua(C)  ■  EmptyPage 
4  N"RealCyl (R,  Slot.D.Addr  ■  C.Addr) 

4  N"RealCul (R,  Slot. 1) .Exists) 

4  E"Sn:  SuapReq,  SB:  SuapBlok  (SR<:N"SuapQueue  4  SBcSR 

4  SB. Frame  «  PF.Addr  4  SB.ReqTupe  ■  Direction 
4  SB.Notify  •  R.ProcName  4  SB.IU  ■  10 
4  SB. Slot  «  (N"RaalCyl (R,  Slot.l),  Slot. 2) 

4  SU. Check  -  (RealSpoolCyl  (R,  Slot.lJ.Exlete 
m>  NoChecks 
<>  Clear)  ) 


51 


21  flay  1378 

2.16  Spool iny  Functions 


Sy*t*fti  Dsvftiopmtnt  Corporation 

rn-6062/181 /08 


transform  RalaasaSpoolCylindar  (V,  SpoolCul  indarAddra.,, 

KProcBlok) 

r.fcond  R.alCyl  If*.  W.fel.t.  *  R.ProCyp,  .  WCP  « 

aMact  -^"RaalSpoolCyKR,  V). Exists 

5  N  SpooiStatus (RtalSpoolCyl (R,V) .Addr)  . 


Fra# 
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2.17:  Sand/Racaive  flassaga 
Functions 


This  section  contains  tha  kernel  functions  that  provide 
communication  between  processes.  Trusted  processes  can  both  sand 
and  receive  messages  from  all  other  procassaa.  Sami-  trusted 
proceaaes  can  only  receive  messages.  NKCPs  can  sand  mesaagas  to 
both  semi -trusted  and  trusted  processes,  but  can  recalva  only  from 
trusted  processes. 


type  flessageld  -  structure  of 

(MsgTypc  -  (OnoUay  TuoWay,  Reply), 

/*  follouing  meaningful  only  if  tlagType  *»■  OneUay  */ 

Name  ■  requcotName, 

/*  follouing  meaningful  only  If  MsgType  ■  TuoUay  >>/ 

Time  »  Uns i gnedOoub I eUord) 

type  MsgBlok  -  structure  of 

(Sender  -  ProcessName, 

Message  Id  «•  Mesaageld, 

Contents  «  T"l:  list  of  Quta  (C"U  <•  PageSlze*1824) , 
MogLencjth  »  T"I:  integer  (I  >■  0  &  I  <•  PageS izetfl 024)  ) 
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transform  Rece i veMessage (Buffer}  Addres370, 

R:  KProcBlok, 

MeasageLength:  ByteOffset, 

Senders  ProcessName, 

Id:  Messageld) 

refcond  n.flcGsacjePendincjnecei ved  &  R.MessageQueue  nil 
&  CheckVPage (R. AddressSpace,  Buffer. 1) 

&  Duffer. 2  +  Messagelength  <■  PageSize  *  1024 
&  LET'Ad  »  Rea lAddresIR. AddressSpace,  Buffer. 1) 

8Ad.2 

8LET"PF  ■  U"PF:  PageFrame  (PFcRealPages  &  PF.Addr  ■  Ad.l) 

&  PF. Status  -  ReadUrite 

effect  ~N"R.MessagePendingReceived  &  N"R.MeasageQueue  ■  R.MessageQueuei2 
&  N"Id  ■  R.MessageQueue. 1. Message  Id 
8  N”Sender  «  R.MessageQueue. 1. Sender 
&  N"MessageLength  »  R.MessageQueue. 1. Length 
&  A" i sDyteOf fset  (i  <  N"MessageLength  -> 

N"PF. Contents. (i+8uffer. 2)  - 

R.MessageQueue. 1. Contents. i ) 

4  N"R.MessagePending  ■  (N"R.MessageQueue  <*■  nil) 
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transform  SendMessage ( ID«  flessageld, 

MessageLength:  ByteOffset, 

Messages  Addro3s370, 

D. 

R:  KProcBlok) 

rafcond  RcProcessLi  st  &  OcProcessList 

4  (SendMcosageAl louecHR.ProcName,  O.PrccName)  I  R.Proctype  -  TRUSTED) 

5  CheckVPagc (R.AddressSpace,  Message. 1) 

4  Message. 2  +  MessageLPngth  <•  PageSize  *  1024 
4  LET"Ad  »  Rea lAddress (R. AddressSpacs,  Message. 1) 

4  Ad. 2 

4  LET"PF  ■  U"PF:  PageFrame  (PFcRealPages  4  PF.Addr  ■  Ad.l) 

effect  (R. Id.MsgType  ■  Reply  &  *€"B!ClockBlok 

(8<: Cl ockCompQueue  4  o.Proc  *  D.ProcName 
4  B. Reason  -  MessageReq  &  B.Id  -  ID. Name) 

•>  N"0  »  0  S  N"C I ockCompQueue  -  C I ockCompdueue  &  N"R  »  R 
<>  N"D.Mc3qagsPending 

4  El"M:MscjQlok  (N"D.MessageQueue  -  D.MessageQueue  II  S"  (M) 

4  M. Sender  -  R.ProcName 
4  M. Length  -  MessageLength  4  M.Messageld  >  ID 
4  A" i s ByteOffset  (i  <  MessageLength  -> 

M. Contents. i  -  PF. Contents.  (Message. 2+i )  )) 

4  M.Messageld. Name  -  (  IO.MsgType  -  OneUay  «>  0 

<>  ID. Name) 

4  N" D.MessageQueue  -  D.MessageQueue  j.  M) 

4  (IO.MsgType  »  OneUay  «>  N"C I ockCompQueue  -  C i ockCompQueue 
<>  IO.MsgType  •  TuoUay  ->  E"B:ClockBlok 

(N"C I ockCompQueue  »  C I ockCompQueue  II  SN  (B) 

4  B. Pr oc  »  R.ProcName 
4  B. Reason  ■  MessageReq  4  B.ID  -  ID. Name 
4  B.Time  -  SYSTEM-TODCIock  +  ID. Time) 

<>  IO.MsgType  *  Reply  ->  E"B!  ClockBlock 

(BcClockCompQueue  4  B.Proc  ■  R.ProcName 

4  6. Reason  •  MessageReq  4  B.ID  -  ID. Name 
4  N"C I ockCompQueue  - 

C I ockCompQueue  ~~  S"  (B)  )  ) 
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transform  ReadCPUI d ( IDs  Processorld, 
Rs  KProcBlok) 

effect  N" IU  -  SYSTEM-CPUld 
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2.18:  Timing  Funct ions 


This  section  contains  the  kernel  functions  that  control  and 
support  three  of  the  four  timers  provided  by  the  S/370.  Each  NKCP 
is  provided  with  its  oun  set  of  virtual  timers,  which  are  mapped 
onto  the  real  set  uhen  the  NKCP  is  active.  The  three  provided 
timers  are  the  interval  timer,  the  CPU  timer,  and  the  clock 
comparator.  The  lot  tor  is  used  for  two  purposes  in  KVI1:  the 
kernel  uses  it  to  time  out  two-way  messages,  and  the  NKCP  may  also 
use  it  for  i  t-j  oun  purposes.  'The  kernel  maintains  a  queue  of 
requests  to  set  the  clock  comparator.  The  fourth  timer,  the  time- 
of-day  clock,  is  >*630  by  a  non-pr i vi  leged  instruction,  KVI1/370 
provides  no  facility  to  write  it  during  normal  operation,  out 
treats  i t  as  a  read-only  object. 


constant  Oelta  -  1000  /#  Time  in  microseconds  to  handle  a 

Kernel  Call  and  redispatch  n/ 
var iable  SETTime:  Si gnedOoub I euor d 

type  ClockBlok  -  structure  of 

(Time  -  UnSi gnedOoub I eUord, 

Proc  *  ProcessName, 

Reason  ■  (Clockfioq,  MessageReq) , 

/it  fol  louiny  meaningful  only  if  Reason  ■  flessageReq  it/ 
Id  ■  Requos tNamei 

variable  C I ockCompGueue:  set  of  ClockBlok, 

SysteniClockCompid:  ClockBlok 


57 


System  Development  Corporation 
Ttl-6062/1 01/00 


21  hay  1978 

2.18  Timing  Functions 


} 


transform  SetClocKComparatordlMEt  UnsignedOoublsuord, 

Rt  KProcBlok) 

effect  E"Bj  ClockDlok  (B<tN"CI ockCompQueue  &  B.Ppoc  »  Requester 
&  0. Tints  •  TIME  &  B. Reason  ■  ClockReq 
&  A" 2:  Clock? lock  (z<tN"C I ockCompQueue 

&  z.Proc  ■  B.Proc  8  z. Reason  *  ClockReq 
->  z  -  B>) 

&  N"R.CloekCompInterruptPending  ■  False 
&  El"x<? N"C I ockCompQueue  (NHSY5TEMCIockComparator  •  x.TIme 

&  N"SystemClockCompId  »  x) 

8  A"y<iNHC I ockCompQueue  (y.Time  >■  N"SYSTEMCIockComparator) 
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transform  C lockCompara tor  Interrupt () 

re  f cond  Sys  temC  I  ockCompI  do  C I  ockCompQueue 

4  El"Ps  KProcBlok  (PoProcessLi et  4  P.Name  •  SystemClockCompId.Proc) 
4  LET"B  -  U"ClockBlok  (SustemC I ockCompI d  •  B) 

Av  Note:  ClockComporatorlnterrupt  occurs  when 

SYSTEMIC  I  ockContpar  a  tor  <  SYSTEM«-TODC  I  ock  ft/ 

effect  B. Reason  «  ClockReq  ■>  N"P.ClockCompInterruptPending 
4  N"C I ockCompQueue  ■  C I ockCompQueue  ~~  S" (B) 

<>  N"P.(1essagePending  -  P.MessagePending  j  B.Id  ) 

4  (  N"C I ockCompQueue  -  nil  -> 

N"Sy3 temC I ockComparator  -  MaxClockCompValue 
<>  N"C  I  ockCompQueue  nil  ->  E"xoNHC  I  ockCompQueue 
(A"y<:N"C I ockCompQueue  (y.TIme  >■  x.Time) 

4  N"Sy8tejnC  I  ockComparator  -  x.Time 
4  N"SystemC I ockCompI d  -  X)) 


CLOCK  COMPARATOR  INVARIANTS:  A"x:ClockBlok  (x<: Cl ockCompQueue  -> 

x.Time  >-  SYSTEMC I ockComparator) 
A " y ,  z : C I ockB I  ok  ( u <: C I ockCompQueue 
5  z<: Cl ockCompQueue 
4  z.Proc  -  y.Proc 
4  z. Reason  -  ClockReq 
4  y. Reason-  ClockReq 
->  z  -  y) 

Cl  ockCompQueue  <*-  nil  ->  SystemC I ockCompI d<: Cl ockCompQueue 

4  SystemClockCompId.Time  -  SYSTEMC I ockComparator 
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transform  SetCPUTimer (Time:  SignedOoubleuord, 

R:  KPracBlok) 

refcond  R.Proctypo  •  NKCP 

effect  N"R.CPUTimor  «  Time  .  ’ 

&  (Time  <  N " R. Renta ir.ingQuan turn  •>  N"R. Track ingQuantum  •  False 

8  N"SETTime  -  Time 

<>  Time  >«  N"R.RemainingQuantum  ->  N"R.  Track IngQuantum  ■  True 

&  N"SETTime  •  N"R.RemainingQuantum) 

&  N"SYSTErt-CPUT  inter  <-  NHSETTime 
&  N"SYSTE.H«-CPUT i mcr  >-  N"SETTime  -  (Delta  *  4096) 

&  N"R.CPUTimer InterruptPending  -  False 

8  (R.  Track  ingQuantum  ■>  N"R.RamainingQuantum  ■  SYSTEf1«-CPUT I mer 
o-vR.  Track  ingQuantum  ■>  N"R.Rs<>  siningQuantum  • 

R . Rema i n i ngQuan  t un-R . CPUT i mer 
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transform  ReadCPUTimor (R:  KProeSlok, 

Time:  SignedOoubleword  /*  output  >v/  ) 
refcond  R.Ppoctypo  «  NKCP 

effect  (R. Track i ngQuantum  ->  N"Time  -  R.CPUThner  - 

eve  tcm ' n ’ n?9U8n  * um  + 

<>a.R,  Track  i ngQuan turn  «>  N"Tlm*  .  SySTEfttcPUTliner ) 

CPU  TWER  INVARIANTS,  R.Proctype  -  NKCP  (SYSTEfl^CPUTimer  <- 

R«Rema i n i ngQuantum 
!  BYlT?M;?P!2im*r  <•  R.CPUTlmer 
R.RemainingQuantum  <-  R??PUT?i»*r ) <~> 
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transform  CPUTimerlnterrupt () 
refcond  R.Proctypa  •  NKCP 

/*  CPU  timer  interrupt  occurs  when  R.Proctype  ■  NKCP 

4  SYSTEfl-CPUTimer  <  0  */ 


effect  (R.  Track  incjQuantum  ->  N"R.CPUTimer  -  R.CPUTimer  - 

R.RemainingQuantum  + 

„  „  .  SYSTEf1«-CPUTimer 

&  N  R .Rema i n i ngQuan turn  •  flaKCPUTimer Value 
4  N"5ETTime  -  NMR.CPUTimer 

4  N'"R.  Track  ingQuan  turn  -  False  4  N"R. Quant umEnded  «  True 
<>~R. Track ingQuan turn  ■>  N"R.RemalningQuantum  »  R.RemainingQuantum 

-  R.CPUTimer  +  SYSTEMrCPUT i mar 
4  N"R.CPUTimer  -  MaxCPUTimerValue 
4  N"SErTims  «  N"R.RemainingQuantum 
4  N''R.  Track  ingQuantum  »  True 
4  N " R . CPUT i mar  1 n ter rup tPend 1 ng  ■  True) 

4  N"SYSTEM*-CPUT i  mer  <-  N"SETTiffle 

4  N“SYSTEN«-CPUT i  mer  >« 

N"SETTime  -  (Delta  it  4096) 
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transform  Setlntcrval Timor (Times  Integer, 

Ri  KProcBlok) 

refcond  R.Proctgpc  *  NKCP 
effect 

N"SYSTEf1«-TII1ER  <-  Time 
*  N"SYSTEH*-Tlf1ER  >*  Time  -  (Delta  *3/40) 
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transform  ReadJntarval Timer (Ri  KProeBlok, 

Time*  integer  Av  output  */  ) 

refcond  R.Proctype  -  NKCP 

effect  N"Time  <-  SYSTEM-TIPIER 

8  N"Tlme  <-  SYSTEMS  I MER  +  (Delta  *  3  /  40) 
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transform  Interval  Timer  Interrupt  () 

refcond  R.Proctypo  *  NKCP  4  SYSTEM*-T I MER  <  0 

Av  An  Interval  timer  Interrupt  occurs  uhen  the  machine  timer  update! 
N"SYSTEft«-TIMFn  -  SYSTEf1«*Tlf1ER  -  INTVL  P 

causes 

N"SYSTEf1*-TIf1ER  <04  SYSTEMS  I  TIER  >-  0  */ 
effect  N"R.  IntvlTlmerlnterruptPendlng  ■  True 
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2.19:  10  Functions 


This  section  contains  the  kernel  functions  that  perform  real  10. 
Oetails  of  the  functions*  operation  mau  be  found  In  the 
preliminary  design  document  of  KVtt/370,  TM-5855/200/08. 


type  CCUAcceosFlaqo  »  structure  of 
(Access  »  (Urite.  Read), 

TIC  >  boolean,  DataTransfer  ■  boolean.  OataChaining  •  boolean. 
Multi  Track  >  boolean,  Seek  ■  boolean) 

type  IQintBlok  ■  structure  of 
(10:  Reque3tNamo, 

CSU:  ChannelStatusUord) 

type  LockcdBox,  ProprocossedChannelProgram,  SeekArg,  IDAU, 

CCUCount  -  T"I:  integer  (0  <■  I  &  !  <  GS538) 

variable  lORequestCount:  integer,  LockedBoxLlst:  set  of  LockedBox 
constant  LookCCW (PreprocessedChannelProgram,  CCUCount):  Channe ICommandUord, 
ChcckT  I C  (ProprocessedChanne  I  Program,  CCUCount,  By  teOf  f  set) :  boolean, 
LooklDA (PreprocessedChannelProgram, AJdres8370,YPage) :  IOAU, 

IOACount (PreprocessedChannelProgram,  CCUCount):  VPage, 

LookSeek (PreprocessedChannelProgram,  Address370) : SeekArg 
variable  lQFLAGSIDeviceAddress,  CCUOpCode)  :CCUAccessFlags 
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transform  RequestlQ(Devicat  OevicaAddrass  Av  0.  .4095  */  . 

Channel  Program  PraprocessadChannalProgram 
Av  includes  CCUa,  10AU  list, 
search  and  aaak  arguments  >v/ 

VMs  Vir tualrtachlnaNama 
!□:  Reques tName, 

R:  KProcBlok) 

refcond  LET"G  ■  GrantedAccess  (Oevice,  Raquaatar)  4  CheckASpaca(R,VH,0) 

4  A"I»intener  (i  >  0  4  I  <•  Channe (Program. NCCUe  -> 

LET " CCU  -  LookCCU (Channe lProgram,  I ) 

4  (i  <  ChannelProgram.NCCUs  «>  CCW.Cha InCommand) 

4  LET"F  -  I QF lags (Oavica,  CCU.Opcoda) 

4  (F.Accass  *  write  ->  G.Accass  «  ReadUrlte) 

4  (F.TIC  ->  CCU.Addr  <  ChannelProgram.NCCUs 
4  i  >  1  4  Mod i f (CLUJ  -nil 
4  ^LookCCU (Channe (Program, 1-1) .DataChaln 
4  CCU. Count  -  1 

4  CheckTJC (ChannalProgram.CCU.Addr, I ) ) 

4  (F.OotaTransfer  -> 

A"  i  i  i  integer  ( I  icCCU.OataChalnExtensions 
4  i  i  >  0  -> 

LET"CCUX  -  LookCCU (Channel Program, 1 1) 

4  CCUX. Opcode  -  CCU. Opcode 
4  CCUX. IndirectAccesa) 

4  A"  IOAcCCU.  IDALi  st 

(Lat"Ad  -  Rea  I Address (A, IDA. 1) 

4  Ad. 2 

4  LET"PF  -  U"PF:PagaFrame 
(PF.Addr  -  Ad.l 
4  PFcRealPages) 

4  (  F.Accass  -  Urite  -> 

PF. I  LOCK  -  0 

4  AH j; integer  ( j  >  0 
4  j  <-  Channel Program. NCCUs  -> 

(i  >  ]  I  IET"CCU2  -  LookCCU (Channel Program. j) 

4  (CCUZ.Skip  I  !0Flags(0evice,CCU2. Opcode) .Access  Read 
I  A" IDA2<:CCU2. IDALi ot  (Rea  I  Address (A, I0A2.1) 

Ad.l)  )  )) 

<>  F.Accass  -  Read  «> 

CCU. Skip  I 

PF.OLOCK  -  0 
4  A"k:  integer 

(k  >  0  4  k  <"  ChannelProgram.NCCUs  -> 

(i  -  k  I  LET"CCU3  -  LookCCU (Channe I Progr am, k) 

4  I0Flags(0evice,CCU3. Opcode) .Access  -Read  -> 

A"  I0A3<:CCU3. IOAUords (Real  Address (A,  I0A3. 1) .  1  Ad.l))  ) 
<>  <*F.OataTranafer  ■>  *£CU.  IndirectDataAccasa) 
4(CCU.Chain0ata  ->  F.OataChaining)  • 

4  F.tlul  ti  Track  ->  -G.Hor  izontal 
4 (F. Control  ->  (CCU. Count  -  1  4  CCU.SLD) 

4(G.CIass  -  DASO  -> 

(F.Sesk  -> 

(G, Ful lOi sk  »>  True 
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<>C,Hor izontal  ->  CCU. SeekAddr.Head<»G.  Tracks 
<>G. Vertical  »>  CCU.SeekAddresa.CyUiG.Cyla)) 

4(i-l  ->  (CCU. Opcode  -  Seek  I  CCU. Opcode  -  SeekCy  I  inder) ) 
4(1-2  ->  (CCU. Opcode  -  SetFileHask 
4  LET  FM  ■  CCU.Fi  lellaek 
4 (G. Access  -  Readonly  «» 

FM.Permi tUr I te  -  Inhibi tUr its 
<>G. Access*—  ReadOnly  -> 

FM.Permi tUrite  *»•  Permi  t  A I  I  Ur  I  te) 

4 (G. Horizontal  ■>  FM.Permi tSeek  • 

Inhibi tA I  I  Seek 

<>G. Vertical  ->  FM.Permi tSeek  «—  Permi tA 1 1  Seek 
&  FM.Permi  tSeek  *»•  PermitCyl 
oG.FullDisk  ->  FM.Permi  tSeek  «<■  Permi  tAIISeek 
<>G. Dedicate  ■>  t'-ue) 

4  FM. Inhibi tO iagUri te  -  true)) 

<>  True) ) ) ) 
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effect  N" IORequestCount  ■  IORequestCount  +  1 

4  E"LB:  LockcdBox  (N"LockedBoxL i st  -  LockedBoxLi st  II  S” (LB) 

4  LB. Mum  ■  IORequestCount 
&  LB. 10  -  10 

4  LB.NCCWs  •  Channe I  Program. NCCUs 
4  LB.Oev  -  Oevice  4  LB.Notify  -  R.ProcName 
4  A"LBX<:LockedBoxLi st  (LBX.Num  <  LB.Num) 

4  A" i : integer  (i  >  0  4  i  <■  Channe I  Program. NCCUs 
->  LET"CCUA  ■  LookCCU (Channe IProgram, i ) 

4  LETTCUN  -  (LB.ChanProg.  i) 

4  LET’TF  ■  lOFIags(Oevice, CCUA, Opcode) 

4  CCUN. Opcode  -  CCUA. Opcode  4  Modi f (CCUN)  -  Modif  (CCUA.) 
&  CCUN. Count  *  CCUA. Count 
4  CCUN.Addr  -  CCUA.Addr  +  LOC(LB) 

4  (F.OataTransfer  ■>  A" js integer  (j  >  0 
4  j  <«  C'CCUA. IDALi st 
->  LET "UN  -  CCUN. IDALi st. j 
4  LET"UA  -  CCUA. IDALi st. j 
4  UN. 2  -  UA.2 

4  LET"AdN  -  Rea  I  Address (A. UA.l) 

4  UN.l  -  AdN.l 

4  LET’TFN  -  U"PFs  PageFrame (PF<: Rea  I  Pages 
4  PF.Addr  »  AriN. 1) 

4  (F. Access  -  Urite  «>  N"PFN.OLOCK  -  PFN.OLOCIC  +  1 
<>  F, Access  »  Read  4  ~CCUA.Skip  ■> 

N"PFN. I  LOCK  -  PFN.ILOCK  +  1 
4  ~N"PFN.(JLQCK  4  «-N"PFN.  TLOCK) ) 
oF.Seek  «>  LockSeek (Channe IProgram, CCUA.Addr)  ■ 
LookSeek (LB.ChanProg, CCUN.Addr) 


Access  4  ~F.Seek  ■>  True))) 
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transform  Star tIO(LockedBoxId:  integer, 

R:  KProcBlok) 

refcond  R<sProce3sL i st  8  R.ProcName  ■  SCHEDULER 

&  LET"L  --  LB:  LockedBox(LB<sLuCkedBoxLi  st  8  LB.Num  »  LockedBoxIO) 

8  ~InProcess (L) 

8  A''B:  LockeriBox  (BcLockedBoxLi st  8  InProcess(B) 

->  8. Dev  L.Oev) 

effect  N"lnProces3<L)  8  MachineDependent 
/*  Eventual  10  Daemon  effects 

<vN" I nProceoe (L)  8  LET"P  —  U"B:<ProcBlok  (B.ProcName  -  L. Notify) 

8  N"P. IOIntcrruptPending 

8  E"B: IOintBlok  (B<:N"P. !0i nterrupts  8  B.ID  •  L.IO  8  B.Dev  ■  L.Dev) 
8  AMC:  LBCCU  (CcL.ChanProg 

->  LET"F  -  I0Flag3(L.0ev,  C. OpCode) 

8  (F.0ataTran3fer  ->  A"U:  Addreaa370 

(U<:C. I  DAL i s  t  ->  LET'PF  -  U"P:  PageFrame 
(PcRealPages  8  P.Addr  -  U.l) 

8  (F. Access  -  Unite  ->  N"PF.OLOCK  -  PF.OLOCK  -  1 
<>  F. Access  -  Read. «>  N"PF.IL0CK  -  PF.ILOCK  -  1 
<>  true)))) 

8  MachineDependent  it/ 
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transform  Cancel  10(10:  RequestName, 

R:  KProcBlok) 

refcond  RcProcessL  i  st 

5  El "LB:  LockedBox  (LBcLockedBoxL i st 

&  LB. Notify  ■  R.ProcName 
&  LB. 10  -  10) 

effect  E"LB:  LockedBox  (LBcLocKedBoxList 

&  LB. Notify  ■  R.ProcName 
&  LB. 10  •  10 

&  N"LockedBoxLi  st  -  LockedBoxList  S"  (LB) 

A  (InProcass(LB)  ->  flachinaQependent) 

&  •*N"InProcess(LB) 

&  A “Cj  LBCCU  (CcLB.  ChanProg  -> 

IET"F  «  IOFIags(LB.Oev,C. OpCode) 

5  F.OataTransfer  ->  A"U:  Address370 

(U<:C. IOAList  ->  LET"PF  .  U"PF:PageFrame 
„  .  (PF<: Rea  I  Pages  &  PF.Addr  «  U.l) 

&  (r. Access  -  Write  «>  N"PF.0L0CK  -  PF.0LQCK  -1 
<>  F.  Access  -  Read  N"PF. IL0CK  -  PF. IL0CK  -1 
<>  true)))) 
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transform  Uai t IQ (Device:  Dev i ceAddress, 

Channe I  Program:  PreprocessedChanne I Progr am, 

R:  KProcBlok) 

refcond  RcProcessL  i  st 

&  n.FrocType  -»  NKCP 

&  LET"G  •>>»  GrantedAccessIDevice,  R.ProcName) 

&  A"CiChanne iControlUord  (CoChannelProgram.CCUs  -> 

LET"F  -•  I  OF  lags (Dev ice,C .Opcode) 

H  -»F.  TIC 

&  A"U:  IDAU  (UcC.  ICAI  1st 

->  LET"RA  ■  RealAddres9(R.AddressSpace,  U.l) 

&  RA.2 

&  UET"PF  -  U"P:PageFrame  (PcReafPages 

4  P.Addr  ■  RA.2) 

&  (C.ChainOata  ->  F.OataChaining) 

&  (F.hul t i Track  ->  ^.Horizontal) 

&  (F. Access  -  Urite  ->  PF.ILOCK  -  0 
&  A" j: integer  ( j  >  0 

&  j  <  Channe I Pr ogram.NCCUs 
->  LET"C2  -  LookCCU (Channe I  Program,  j) 

&  (C2.SKIP  I  I  OF  lags  (Dev  ice,  C2.  OpCode)  .Access  Read 

I  A"U2: IDAU 

(U2<sC2. IDAList  ->  Rea  I  Address (R. AddressSpace,U2. 1) . 1  RA.l))) 

<>  F. Access  ■  Read  ->  C.SKIP  I 
PF.OLOCK  -  0 
&  A"K; Integer 

IK  >  0  U'  <  Channe I  Program. NCCUs 

->  l_ET"C3  ■  LookCCU (Channe I  Program, K) 

&  l IOF I ags(0evics,C3. OpCode) .Access  *»<■  Read 
I  A"U3: IDAU(U3<:C3. IOAUords  > 

Real  Address (R. AddressSpace,  143. 1 ) .1  RA.l))) 

<>  true) 

&  (F.DASO  ->  G.Ful IDisk))) 


effect  MachineOependent 
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3.1.1:  Operator  Process 

Informal  Description 

This  section  contains  the  informal  description  of  the  Operator 
Process  of  KVM/370. 


Overview 

The  Operator  Process  is  linked  to  the  operator’s  console  at  system 
initialization.  The  Operator  Process  thereafter  accepts  operator 
commands,  and  routes  tha  command  either  to  the  affected  NKCP,  or 
to  the  trusted  process  which  is  to  perform  the  actions  dictatad  by 
the  command.  For  the  most  part,  the  Operator  Process  merely 
routes  the  message,  with  iittle  or  no  notice  of  the  details  of  the 
command.  The  few  commands  requiring  further  processing  are  noted 
below.  Necessarily,  the  Operator  Process  must  know  where  the 
command  is  to  be  sent  for  processing.  Thi3  often  involves  mapping 
a  command  operand  such  as  a  user  id  into  an  NKCP  id.  The  Operator 
Process  sends  requests  to  the  Authorization  Process  to  perform 
such  mappings.  The  VM  operator,  commands  have  been  separated  by 
function  into  four  categories:  Miscellaneous,  Spooling  and  File 
Control,  Device  Control,  and  Program  Analysis  and  Monitor 
functions.  These  categories  are  described  below. 
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KVM/370  Operator  Commands 
(see  notes  at  end  of  table) 


Command 


AUTOLOG 

DIAL 

FORCE-USERID 
FORCE eALL 
I ND l CATE-LOAD 
I ND I  CATE-QUEUES 
INDICATE- 10 
I NO I  CATE-PAGING 

I  NO I  CATE-USER 
LOGON 
LOGOFF 
HALT 

LOCK-USERID 
LOCK-SYSTEM 
MESSAGE-USERID 
MESSAGE-ALL 
MONI TOR-NKCP 
MON I  TOR- ALL 
NETWORK 
QUERY-PAGING 

QUERY-PRIORITY 

QUERY-SASSIST-NKCP 

QUERY-SASS I  ST-ALL 

QUERY- OASO 

QUERY-TAPES 

QUERY-LINES 

QUERY-GRAF 

QUERY-SYSTEM 

QUERY-NAMES 

QUERY-USERS 

QUERY-USERID 

OUERY-UR 

QUERY-ALL 


s 

M 

Resp 

Exp 

Map 

Destin- 

ation(s) 

Category 

S 

not 

Y 

legal 

N 

AuthProcess 

1.1 

0,0 

S 

N  ( 1 ) 

U->N 

NKCP 

V<r3 , 0 

M 

N  (1 ) 

N 

al 1  NKCPs 

*2,0 

M 

Y 

N 

all  NKCPs 

2,3 

M 

Y 

N 

al 1  NKCPs 

2,4 

S 

Y 

N 

I/O  Scheduler 

1.1 

S 

Y 

N 

I/O  Paging 
Scheduler 

1.1 

s 

not 

not 

Y 

legal 

1  egal 

U->N 

NKCP 

3,1 

0,0 

s 

(2) 

N 

Kernel 

5,0 

S 

•Y 

U->N 

NKCP 

3,1 

S 

Y 

N 

NKCP 

1,1 

S 

N 

U->N 

NKCP 

*3.8 

n 

N 

N 

all  NKCPs 

*2,0 

S 

Y 

N 

NKCP 

1,1 

M 

Y 

N 

all  NKCPs 

2,2 

S 

Y 

N 

Netuork  Process 

1,1 

S 

Y 

N 

I/O  Paging 
Scheduler 

1.1 

S 

Y 

U->N 

NKCP 

3,1 

s 

Y 

N 

NKCP 

1.1 

M 

Y 

N 

all  NKCPs 

2,2 

S 

Y 

N 

AuthProcess 

1.1 

S 

Y 

N 

URProcess 

1.1 

S 

Y 

N 

AuthProcess 

1.1 

S 

Y 

N 

AuthProcess 

1.1 

S 

Y 

N 

AuthProcess 

1.1 

S 

Y 

N 

AuthProcess 

1,1 

S 

Y 

N 

AuthProcess 

1,1 

s 

Y 

N 

AuthProcess 

1.1 

s 

Y 

N 

URProcess 

1.1 

M 

Y 

N 

AuthProcess, 

URProcess, 

Kerne  1 

9,2 
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Command 


QUERY«-OUMP 

QUERY.-TOSK 

QUERY«-STORAGE 

QUERY«-RAOnR 

QUERY.-FILES 

QUERY*- READER 

OU!7RY«-PR  INTER 

QU';RY«-PUNCH 

ObGRY-HOLD 

QUERY-LriGnsG 

SET^FAVOREn 

SET*-RESERVED 

SET^PRIORITY 

SET«-SAS3 1  ST«-NKCP 

SE  T *-SASS  I  ST «-ALL 

SET«-LOGMSG 

SET*-DUDP 

SET«-RECORO 

SET-MODE 

SMUTDOUN 


SLEEP 

UNLOCK-USERID 

UNLOCK-SYSTEM 

UNLOCK-VIRT 

UARNING-USERIO 

UARN I  NG-ALL 

BACKSPAC 

CHANGE 

ORA  IN 

FLUSH 

FREE 

HOLO 

OROER 

PURGE 

REPEAT 

SPACE 

START 

TRANSFER 


;2l*AHC<i^lSE-v 
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S 

n 


Resp 

Exp 


M  Y 

S  (2) 

S  Y 


S 

S 

S 

s 


s 

s 

s 

s 

M 


Y 

Y 

Y 

Y 

Y 

9SS 

Y 

Y 

Y 

Y 

Y 


Rap 

Oest  in- 

Category 

at ion  (9) 

\ 

N 

Dump 

1.1 

Processor 

N 

at  1  NKCPs 

2,2 

N 

Kernel 

5,0 

R->T 

URProcess  or 

4,1 

AuthProcess 

N 

URProcess 

1,1 

N 

URProcess 

1,1 

N 

URProcess 

1,1 

N 

URProcess 

1,1 

i 

N 

URProcess 

1.1 

irect ly 

8,0 

U->N 

NKCP 

3.1 

U->N 

NKCP 

3,1 

U->N 

NKCP 

3,1 

N 

NKCP 

1.1 

j 

N 

al  1  NKCPs 

2.2 

> 

recti y 

8.0 

i 

N  • 

Dump 

*1 . 0 

t 

Processor 

\ 

1 

not 

not 

ri 

legal 

legal 

N 

N 

AuthProcess 

not 

S 

legal 

Y 

U--*N 

URProcess, 
all  NKCPs 

NKCP 

5 

Y 

N 

NKCP 

not 

S 

legal 

N 

U->N 

NKCP 

n 

N 

N 

NKCP 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

s 

Y 

N 

URProcess 

8.0 

0.0 

10,0 


8,0 

3.1 

1.1 
0.0 

*3 , 0 
*2.0 
1,1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 
1.1 


.  j 


i. 
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Command 

s 

Rasp 

Map 

Oest in- 

Category 

ATTACHE-CHANNEL 

ATTACHe-RADOR 

M 

not 

S 

Exp 

legal 

Y 

R->T 

at ion(s) 

URProcess  or 

0.0 

4.1 

DET  ACHe-CHANNEL  . 
OETACH-RADUR 

not 

S 

1  egal 

Y 

R-»T 

AuthFrocess 

URProcess  or 

0.0 

4.1 

DISABLE 

S 

Y 

N 

AuthFrocess 
Network  Process 

1,1 

DISCONN 

ENABLE 

not 

S 

legal 

Y 

N 

Network  Process 

0.0 

1,1 

LOADBUF 

S 

Y 

N 

URProcess 

1,1 

VARY 

s 

Y 

R->T 

URProcess  or 

4,1 

ACNT.-USERID5 

Both 

Y 

U->N 

AuthProcess 
some  NKCPs 

7,2 

ACNTe-ALL 

M 

Y 

N 

all  NKCPs 

2,2 

DCP 

S 

Y 

N 

NKCP 

1,1 

DMCP 

S 

Y 

N 

NKCP 

1.1 

3.1 

4.1 

LOCATEe-USERIO 

S 

/ 

i 

•J->N 

NKCP 

LOCATEe-RAODR 

S 

Y 

R->T 

URProcess  or 

SAVESYS 

STCP 

not 

S 

legal 

Y 

N 

AuthProcess 

NKCP 

0,0 

1,1 
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Note3: 

The  column  bondings  are  as  follows* 

Command  -  command  name 

S/M  *  single  message  versus  multiple  messages  sent 
Re3p  Exp  *  response  expected  (Y>yes,  N-no) 

Map  -  mappings  performed,  if  anu* 

U  ->  N  m  user  id  to  NKCr  id 
R  ->  T  »  real  device  address  to  device  type 
Destination  -  to  uhat  processes  the  messages  are  sent 
AuthProcess  -  Authorization  Process, 

URProcess  •  Unit  Record  Process 

Category  »  ordered  pair  of  (input  category,  output 
category).  The  category  refers  to  the  classification  of  the 
command  in  the  formal  specification.  Each  operator  command  is 
separated  into  tuo  equivalence  classes  by 

-  the  processing  required  when 

the  command  is  first  received, 
and 

-  the  processing  required  to 

compute  one  response  from  all 
the  responses  to  messages  sent 

in  the  processing  of  the 

original  command, 

(1)  FORCE  command  responses  are  provided  by  the 
Authorization  Process  as  unsolicited  messages  rather 
than  solicited  responses  because  the  number  of 
expected  responses  is  not  Known  and  because  it 
simplifies  the  interaction. 

(2)  A  response  is  provided  immediately  —  no  message 
response  is  needed. 
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OPERATOR  C  0  nil  A  N  0  Si 
MISCELLANEOUS 
FUNCTIONS 


AUTOLOG  iA.B) 

"Automatically  log  on  and  load  a  virtual  machine  with  IPL 
defined  in  its  directory." 

[extend  syntax  to  provide  NKCP  id  (security  level)! 
reflect  message  to  Authorization  Process 
print  response 


DIAL  (Any) 

"Logically  attach  a  user  terminal  to  a  multi-access 
virtual  system." 

not  allowed  as  an  operator  command  in  KVN/370 


FORCE  (A) 

"Force  the  logoff  of  any  virtual  machine." 

[extend  syntax  to  provide  "ALL"  operand) 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
no  response  expected 
[response  from  Authorization  Process] 

ALL  -  reflect  message  to  each  NKCP 

no  response  expected  [separate  responses 
from  Authorization  Process) 


INDICATE  (Ei 

"Display  use  of  and  contention  for  major  system 
resources. " 

LOAD.  QUEUES  - 

reflect  message  to  each  NKCP 
gather  responses 
compute  "average"  response 
print  computed  response 

I/O  -  reflect  message  to  I/O  Scheduler 
print  I/O  Scheduler  response 
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PAGING  -  reflect  message  to  I/O  Paging  Scheduler 
print  I/O  Paging  Scheduler  response 

USER  -  mop  user  id  to  NKCP  id 
•'eflect  message  to  NKCP 
print  NKCP  response 


LOGON  l Any) 

"Gain  access  to  a  virtual  system  from  a  user  terminal." 
not  alloued  as  an  operator  command  in  KVM/370 


LOGOFF  (Any) 

"Terminate  user  activity  on  a  virtual  machine. 

reflect  message  to  Authorization  Process 
(response  from  Authorization  Process] 


HALT  (A) 


"Stop  any  active  channel  program  on  a  specified  device." 

Kernel  Call;  HALT 
print  Kernel  response 


LOCK  (A) 


"Lock  a  user's  pages  in  processor  storage." 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
print  NKCP  response 

SYSTEM  -  [extend  syntax  to  provide  NKCP  id 
(security  level)] 
reflect  message  to  NKCP 
print  NKCP  response 


MESSAGE  (Any) 

"Send  a  specified  message  from  one  virtual  machine  to 
another." 

user  id  -  map  user  id  to  NKCP  id 
reflect  massage  to  NKCP 
no  response  to  operator 
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ALL  -  reflect  message  to  each  NKCP 
no  response  to  operator 


MONITOR  (A,E) 

[Also  listed  under  PROGRAM  ANALYSIS  AND  MONITOR  FUNCTIONS] 

"Initiate  or  terminate  the  recording  of  events  that  occur 
in  the  real  machine." 

[extend  syntax  to  provide  NKCP  id 
(security  level)  /  “ALL"  operand] 

NKCP  id  -  reflect  message  to  NKCP 
print  NKCP  response 

ALL  -  reflect  “'essage  to  each  NKCP 
gather  responses 
print  NKCP  response 


NETWORK  (A,B,F) 

[Also  listed  under  DEVICE  CONTROL  FUNCTIONS] 

"Provide  loading,  dumping,  tracing,  and  other  functions 
for  the  3704/3705  Communications  Controller." 

reflect  message  to  Network  Process 
print  Network  Process  response 


QUERY 


"Provide  status  information  on  the  real  or  virtual 
machine,  and  miscellaneous  CP  functions." 

PAGING  -  reflect  message  to  I/O  Paging  Scheduler 
print  I/O  Paging  Scheduler  response 

PRIORITY  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
print  NKCP  response 

SASSIST  -  [extend  syntax  to  provide  NKCP  id 

(security  level)  /  "ALL"  sub-operand] 

NKCP  id  -  reflect  message  to  NKCP 
print  NKCP  response 

ALL  -  reflect  message  to  each  NKCP 
gather  responses 
print  amalgamated  response 
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DADO,  LINES.  GRAF, 

SYSTEfl.  NAMES,  USERS,  user  id  - 


reflect  message  to  Authorization  Process 
print  Authorization  Process  response 

UR  - 

reflect  message  to  URProcess 
print  URProcess  response 

ALL  - 

reflect  meosage  to  Authorization  Process 
and  URProcess 

Kernel  Calls  STORAGE 

gather  responses 

print  amalgamated  response 

TOSK  - 

reflect  message  to  each  NKCP 

gather  responses 

print  amalgamated  response 

STORAGE 

Kernel  Call:  STORAGE 
print  Kernel  response 

raddr  - 

map  raddr  to  device  type 
if  device  is  unit  record  device: 
reflect  message  to  URProcess 
print  URProcess  response 
else: 

reflect  message  to  Authorization  Process 
print  Authorization  Process  response 

TAPES.  F 

ILES,  READER.  PRINTER.  PUNCH,  HOLD  - 
(extend  syntax  to  provide  NKCP  id 
(security  level)  /  "ALL"  operand! 

reflect  message  to  URProcess 
print  URProcess  response 

LCIGMSG  - 

print  log  message 

DUMP  - 

reflect  message  to  Dump  Processor 
print  Dump  Processor  response 

SET  (A.B.F) 

"Establish  system  parameters  for  virtual  and  real 
machines,  as  well  as  other  Ytl/370  values." 

FAVORED.  RESERVE.  PRIORITY  - 

map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
print  NKCP  response 
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SASSIST  -  (extend  syntax  to  provide  NKCP  id 

(security  level)  /  "ALL"  sub-operand] 

NKCP  id  -  reflect  message  to  NKCP 
print  NKCP  response 

ALL  -  reflect  message  to  each  NKCP 
gather  responses 
print  amalgamated  response 

LCCMSG  -  NULL  -  set  log  message  to  empty  string 

nn  -  read  next  console  line,  and 

make  it  line  nn  in  the  current 
log  message 

DUMP  -  reflect  message  to  Dump  Processor 
(no  response  to  operator] 

RECORD.  MODE  - 

not  allowed  in  KVfl/370 


SHUTDOWN  (A) 

"Terminate  Vfl/370  activity  in  an  orderly  manner  and 
checkpoint  the  system." 

Reflect  message  to  Authorization  Process,  URProce9B,  and  each  NKCP 
no  response  to  operator 


SLEEP  (Any) 

"Flace  the  virtual  machine  in  a  dormant  state,  with  the 
keyboard  locked." 

Not  allowed  as  an  operator  command  in  KVM/370 


UNLOCK  (A) 

"Release  previously  locked  page  frames  of  real  storage." 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
print  NKCh  response 

SYSTEM.  VIRT  - 

not  allowed  in  KVM/370 
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WARNING  (A.B) 

" Transm i t 
a  I  I  user?. " 

user  i  cl  - 

ALL  - 


high  priority  messages  or  warnings  to  a  user  or 


map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
no  response  to  operator 

reflect  message  to  each  NKCP 
no  response  to  operator 
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OPERATOR  COfiflANOSt 
SPOOLING 
AND 

FILE  CONTROL 
FUNCTIONS 


All  Spooling  and  File  Control  Commands  are  reflected  to  the  Unit 
Record  Process  uhich  makes  the  necessary  response.  See  the  Unit 
Record  Process  Description  for  processing  details. 


BACKSPAC  (D) 
CHANGE  (D) 
DRAIN  (D) 
FLUSH  (D) 
FREF  (D) 

HOLD  (D) 
ORDER  (D) 
PURGE  (D) 
REPEAT  (D) 
SPACE  (D) 
START  (D) 
TRANSFER  (D) 


21  May  1978  System  Development  Corporation 

3.1.1  Operator  Process  (Informal)  TM-E0G2/1 01/00 


OPERATOR  COMMANDS: 
DEVICE  CONTROL 
FUNCTIONS 


ATTACH  (B) 

"Attach  a  real  device  to  a  virtual  machine  or  the  real 

system. " 

CHANNEL  -  not  allowed  in  KVM/370 

raddr  -  map  raddr  to  device  type 

if  device  type  is  unit  record: 
reflect  message  to  URProcess 
print  URProcsss  response 
else: 

reflect  message  to  Authorization  Process 
print  Authorization  Process  response 


DETACH  (B) 

"Remove  a  real  or  virtual  device  or  channel  from  a  virtual 
machine  or  the  real  system." 

CHANNEL  -  not  allowed  in  KVM/370 

raddr  -  map  raddr  to  device  type 

if  device  type  is  unit  record: 
reflect  message  to  URProcess 
print  URProcess  response 
else: 

reflect  message  to  Authorization  Process 
print  Authorization  Process  response 


DISABLE  (A.B) 

"Disable  direct  cr  switched  communication  lines  from  the 
VM/370  system." 

reflect  message  to  Network  Process 
print  Netuork  Process  response 


D I  SCOW  (Any) 

"Disconnect  the  terminal  from  the  user’s  virtual  machine." 
not  allowed  as  an  operator  command  in  KVM/370 
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ENABLE  (A.B) 

"Connect  specified  communication  lines  to  the  system." 

reflect  message  to  Network  Process 
print  Network  Process  response 


LOAOBUF  (D) 

"Load  a  specified  train  image  into  either  the  1403 
universal  character  set  buffer  or  the  3211  universal  character  set 
or  form  control  buffers." 

reflect  message  to  URProces3 
print  URProcess  response 


NETUORK 

tSee  MISCELLANEOUS  FUNCTIONS] 
VARY  (B) 


"Allow  or  disallow  the  availability  of  a  device  to  a 
virtual  machine  or  the  VM/370  control  program." 

map  raddr  to  device  type 
if  device  type  is  unit  record: 
reflect  message  to  URProcess 
print  URProcess  response 
else: 

reflect  message  to  Authorization  Process 
print  Authorization  Process  response 


SS 


*  v- 
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OPERATOR  COMMANDS: 
PROGRAM  ANALYSIS 
ANO 

MONITOR 

FUNCTIONS 


ACNT  (A) 


"Render  accounting  information  for  and  to  the  user. 

user  ids  -  map  each  user  id  to  NKCP  id 

reflect  message  to  each  concerned  NKCP 

gather  responses 

print  amalgamated  response 

ALL  -  reflect  message  to  each  NKCP 

gather  responses 
print  amalgamated  response 


DCP  (C.E) 

"Display  real  processor  storage  locations." 

(extend  syntax  te  provide  NKCP  id  (security  level)] 

reflect  message  to  NKCP 
print  NKCP  response 


OMCP  (C.E) 

"Dump  the  real  storage  locations  to  a  user’s 
pr inter. " 


(extend  syntax  to  provide  NKCP  id  (security  level)] 

reflect  message  to  NKCP 
print  NKCP  response 


virtual 
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LOCATE  (C.E) 


"Provide  the  starting  location  of  the  user’s  CP 
blocks  or  (virtual  or  real)  devices." 


control 


user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
print  NKCP  response 

ratldr  -  map  raddr  to  device  type 

if  device  type  is  unit  record: 
reflect  message  to  URProcees 
print  URProcess  response 
el  se: 

reflect  message  to  Authorization  Process 
print  Authorization  Process  response 


MONITOR 

[See  MISCELLANEOUS  FUNCTIONS! 


SAVESYS  (E) 


"Provide  a  storage  copy  of  virtual  machine 
registers,  and  PSU  contents  as  they  currently  exist. " 


storage. 


not  allowed  as  an  operator  command  in  KVM/370 


STCP  (C) 

"Change  the  contents  of  real  processor  storage." 

[extend  syntax  to  provide  NKCP  id  (security  level)} 

reflect  message  to  NKCP 
print  NKCP  response 
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Authorisation  Process 
-  Responses  - 

User  Idflapped 
ResponseTo0pReque3t 

NKCP  Requests 

Opera  torflessage 

QueryLogMsg 

ResponseToOpRequest 

Other  Processes 
-  Responses  - 


ResponeeToOpReques  t 


Other  Processes 
-  Requests  - 


Opera  torflessage 
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) 


3.1.2:  Cperator  Process 

Formal  Specification 


module  OpProcess 
type 

OeviceTypes, 

Char, 

String-  list  of  Char, 

flessageLabe I  •  (RcsponoeToOpReques t, Opera torRequest.MappedUeer Id, 
AcJdNkcp.Oc  I e teNkcp.OpMsgPr inted.OpHi  tAt  tn.OpRequeatRead) , 

Kerne IFunct i on  -  (GrantAccess.ReleaseDevice.CreateProcess, 

Oco  troyP'-occ  os,  Croat  eAddressSpace,  OestroyAddressSpace, 
Request  1 0,  Rece  i  ve  1  n  t  err  up  t  s.  Re  I  easeCPU ,  Rece  i  veMessage) , 


Proce3sName, 

flessageld, 

CommandName  -  (DIAL, LOGON, SET-RECORD, SET-MODE. SLEEP, 

UNLOCK-S YS  TEM .  UNLOCKS  I RT .  ATTACH-CHANNEL ,  DETACH-CHANNEL , 

0 1 SCONN , SAVES YS , 

AUTOLOG.  INOICATE-IO,  I  NO  i  CATE-PAGING, 

LOGOFF . LOCK-SYSTEM , MONI TOR-NKCP . NE  TUORK . OUERY-PAG I NG , 

QUER  Y-SASS I ST-NKCP , QUERY-OASO , QUERY-TAPES . QUERY-L I NES , 

QUERY-GRAF , QUERY-SYSTEM . QUERY-NAMES, QUERY-USERS . QUERY-USER I D,  * \ 

QUER Y-UR . QUERY-CUMP , QUERY-F I LES . QUERY-REAOER . QUERY-PR I NTER ,  J 

QUERY-PUNCH. QUERY-HOLD. SET-SASS I ST-NKCP, SET-DUMP, 

UNLOCK-SYSTEM , B ACKSP AC , CHANGE .DRAIN, FLUSH . FREE . HOLD . ORDER , 

PURGE  .REPEAT, SPACE .START , TRANSFER . D I  SABLE , ENABLE . LOADBUF , 

DCP  OMCP  STCP. 

FORCE-ALL. I  NO i CATE-LOAD, I ND I  CATE-QUEUES, MESSAGE-ALL, 

MON  I  TOR-ALL . QUER Y-SASS I  ST-ALL , QUERY-TDSK . SET-SASS I ST-ALL , 

WARN  I NG-ALL . ACNT-ALL , 

FORCE-USER  I D . I ND I CA  TE-USER . LOCK-USER I D . MESSAGE-USER I D , 

QUERY-PR I  OR  I T Y , SE T-FA VOREO . SET-RESERVED . SET-PR I  OR I T Y . 

UNLOCK-USER  1 0 , UARN I NG-USER I D , LOCATE-USER ! D , 

QUER  Y-RAOOR .ATT ACH-RADDR , DETACH-RADOR , VAR Y , LOCATE-RADOR , 

HALT, QUERY-STORAGE. 

ACNT-USERIOS. QUERY-LOGMSG.SET-LOGMSG. QUERY-ALL, SHUTDOWN), 

Cat0  -  T"  (DIAL. LOGON. SET-RECORD. SET-MODE, SLEEP. 

UNI. OCK-SYS TEM, UNLOCK-V I RT.ATTACH-CHANNEL, DETACH-CHANNEL, 

01 SCONN, SAVES YS), 

Catl  -  T"  (AUTOI.OG,  INTIICATE-IO,  I  NO  I  CATE-PAGING, 

L  nGOFF . LOCK -SYSTEM , MON  I TOR-NKCP . NETWORK , OUERY-PAG I NG . 

Qt  ICR  Y-SASS I S  T-NKCP . QUERY-OASO . QUERY-TAPES . QUERY-L I NES , 

QUERY-GRAF . QUERY-SYSTEM, QUERY-NAMES. QUERY-USERS, QUERY-USERID, 

QUER  Y-UR, 01 IERY-OUMP, QUERY-F II.  ES, QUERY-READER, QUERY-PRINTER, 

Ql  IGR Y-PUNCH . QUERY-HOLD . SET-SASS I ST-NKCP , SE  T-OUMP , 

UNLOCK-SYS TEM , BACKSPAC , CHANGE .DRAIN, FLUSH , FREE , HOLD , ORDER , 

PURGE .REPEAT. SPACE, START. TRANSFER .DISABLE, ENABLE . LOADBUF , 

DCP, OMCP, STCP). 
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3.1.2  Operator  Proems  (Formal) 


System  Development  Corporation 
TM-60S2/101/00 


Cat2  -  T"  (FORCE-ALL,  I  NO  1 CA TE-LOAO, 1ND I  CATE-QUEUES,  MESSAGE-ALL, 

MON  I  TOR-ALL . QUERY-SASS I  ST-ALL . QUERY-TOSK, SET-SASS I  ST-ALL , 
UARN l  NG-ALI. ,  ACNT -ALL) . 

Cat3  -  T"  (FORCE-USERID.  I  NO  1  CATE-USER,  LOCK-USERID,  MESSAGE-USERID, 

Qi  IERY-PR I  OR  I T Y , SET-FAVOREO , SET-RESERVED , SET-PRIOR  I TY, 
UNLOCK-USER  I D ,  UARN  I NG-USER 1 0 ,  LOCATE-USER 10), 

CatA  -  T"  (OUEPY-RAOOR, ATTACH-RAODR, DETACH-RADOR, VARY, LOCATE-RADDR) , 

CatS  -  T" (HALT, QUERY-STORAGE), 

ConsoleOutputStatus  -  (Continuing,  Idle) , 

ResponseStatus  -  (NoResponsa,  Responded), 

RequestCategory  -  (QpRequest.ReadOpRequest.Pr intOpMsg.MapUeerld) , 

Answer  -  structure  oft 
HNS  -  String. 

Text  -String) , 

Responses  lot  -  structure  oft 

Respondent  -  ProcessName, 

Text  m  String, 

State  •  ResponseStatus) , 

PendingRequest  -  structure  oft 
Msyld  -  Message! d, 

Kind  »  HeguostCategory, 

Command  ■  CommanclName, 

Responses  ■  set  of  ResponseSlot) , 

LogLine  -  structure  of( 

Num  -  T" I : i nteger (1  <*  i  &  I  <■  99), 

Line  »  String) 
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3.1.2  Operator  Process  (Forma!) 


System  Development  Corporation 
TM-60G2/101/00 


variable 

Answer*  Met  of  Answer, 

PendingRequests:  sot  of  PendlngRequest, 
LogMessage:  set  of  LogLine, 
CommandExpected:  boolean. 

Conso leOutputStatc:  ConsoleQutputStatus, 
CurrentNkcps:  set  of  ProcessNama 


) 
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21  nay  1978 

3.1.2  Operator  Process  (Formal) 


initial 
Aneuere  •  ni  I 
& 

PendlngRsquests  •  Empty 
4 

LogHeseage  •  Empty 
& 

CommandExpected  ■  true 

4 

Conso I eOutputState  ■  Idle 
4 

CurrentNkcps  ■  Empty 


invariant  _ 

A"Pl,P2:PendinqRequest  (PlcPendmgRequests 

4 

P2<sPendingRequests  -> 

(Pl.Msgld  -  PC.flsgl d  ->  PI  -  P2)) 

4 

A" P:  Pend i nqReque3 1 , R1 . R2 : Responses  I o  t 

(P<:  Pend  inciRcquests4Rl<:P.Responses4R2<:P.  Responses  -> 

(Rl. Respondent  •«  R2. Respondent  ->  R1  -  R2) ) 

4 

A"L1 . L2; LoqL i ne (Ll < J  Logflessage 
4 

LZoLocjMossage  -> 

(Ll.Num  -  L2.Num  ->  Ll  -  L2) ) 


21  flay  1978 

3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TK-6062/1 01/00 


conotant 

OpProccas,  URProccss, AuthProcesa, AcntProceso.UpdaterProcesaj 

ProcessName, 

I  OPag  i  nnSchedu  I  er ,  I  OSchedu  I er , Ne  tuor kProcesa ,  DumpPr ocaasor  t 
ProcossNamo, 

TrustedProcecses  "  S" (OpProceaa.URProceaa, AuthProceas, 
AcntProcens.UpdaterProceas) , 
flsgName  (Str  i  ng) :  HonsageLabe  I , 

□eat inat i on (CommandName) :  ProcessName, 

OeviccTupr  (OcviccAcklrtiSs)  i  OeviceTypes. 

Raddr (Str i ng) i  Dev i ceAddreas, 

ClockRead:  String. 

ErrorMsg:  String, 

Neuflsgld:  flessageld, 

Sendflessage  (ProcessName) :  KernelFunct  i on, 

KFcn (CommandName) s  Kerne IFunct ion, 

Def i nedE I seuhere:  boolean  ■  true, 
flakeStr  i  ng  (set  of  LogLine):  String, 

LogPrompt:  String, 

L  i  ne// (Str  ing) :  T"  I  s  i  nteger  (1  <■  I  &  I  <»  99), 

Line(String) :  String 

transform  Kerne iCal I ed (Ks  KernelFunct i on) 
effect  (K  -  SendMessage  ■>  Oef inedElaewhere 

<>  K  -  GrantAccess  •>  Def i nedE I seuhere 

<>  K  ■  ReleaseDevice  •>  Def i nedE I seuhere 

<>  K  m  CreateProcesa  ->  Def i nedE I aeuhere 

<>  K  ■  OestroyProceas  ->  Def inedEl seuhere 

<>  K  -  CreateAddresaSpace  ■>  Def inedEl seuhere 

<>  K  ■  OestroyAddreasSpace  ->  Def inedElaewhere 

<>  K  »  Request  10  ■>  Def inedEl seuhere 

<>  K  -  Recei velnterrupts  ■>  Def inedEl seuhere 

<>  K  »  ReleaseCPU  ■>  Def inedEl seuhere 

<>  K  »  Recei vettesaage  ■>  Def inedEl suhere 

<:•  true) 


21  May  1978 

3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TM-6062/101/00 


transform  OpCatO (Commands  CommandName) 
ref  cone!  CommandcCatO 

effect  N"Ansuers  ■  Answers; .  (Cl  ocKRead,  ErrorMsg) 
8 

N"CommandExpected 


21  nay  1978 

3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TM-6062 7101/00 


transform  OpCatl (CommandJ  CommandMame) 

re ?cond  CommandExpected 
& 

CommandcCatl 

effect  N"Pend i ngRequests  ■ 

(Command  -  S£T«-0UMP  ■> 

Pend i ngRequests 

<>  Pend i ngRequests  II  S" ( (NewMsgl d, 

OpRequest, 

Command, 

S" ( (Oest inat ion(Command) , 
ni  j , 

NoResponse) ) ) ) ) 

N'TommandExpec  ted 
& 

Kerne iCa I  I ed (SendMeesage (Deet inat i on (Command) ) ) 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 

Tn-6062/101/00 


transform  0pCot2 (Command:  CommandName) 

refcond  CommandExpccted 
& 

Commander Cat2 

effect  N"CommandExpocted 
& 

A"PsProcessName (PcCurrentNkcps  -> 

Kernel  Cal  led(Sendf1e99age(P) ) ) 

& 

(Command  ~<sS"  ( FORCE -ALL,  WARN  I  NG*-ALL)  -> 

N"PendingReque'»t9  ■  PendingRequest9  II 
S" ((NewHsgld, 

OpRequetc, 

Command, 

S"R: Responses  lot (E"PsProce9sName 
(P<:CurrentNkcp3 
& 

R  -  (P.ni I .NoReaponse) ) ) ) ) 

<>  N"PendingReque9ts  ■  PendingRequests) 


( 
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System  Development  Corporation 
TM-S0S2/ 101/00 


transform  0pCat3 (Command*  CommandName, 

Nkopa*  set  of  ProceesNam#) 

refcond  Commands Cat3 

effect  (Nkcps«-CurrentNkcps  ■> 

N"pQndingRequests  » 

(Commands S"  (F0RCE4JSERI0. 

MESSAGEMJ5ERID, 

UARN1NG*-IJSERID)  »>  PandingReoueate 
<>  PendingRequests  II 
S"  ( (NetiMsgld, 

OpRequest. 

Command, 

S "R*  Responses  lot (E"Pi Pr ocessName 
(PcNkcps 
A 

R  »  (P,ni I ,NoRe8ponse) ) ) ) ) ) 

& 

N"CommandExpected 

& 

A"PsProcessName (PcNkcps  -> 

Kerne  I Ca I  led (SendMessage (P) ) ) 

A 

NoError 
<>  Error 

& 

N"Pend i ngRequasts  -  PendingRequests 
& 

N"CommandExpected) 
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3,1.2  Operator  Process  (Formal) 


Sustain  Development  Corporation 
*  TH-6862/101/08 


: 


transform  QpCat4 (Commands  CommanciNama, 

Raddr:  OeviceAddrees) 

refcond  CommandExpccted 
$ 

Command<:Cat4 

effect  N"Pend I nciRcqucs ts  -  PendlngRequasts  II 
S" ( (NcuMoqld, 

.  OpRequeot, 

Commond-  _ 

S" ( ( (Dev i ceTypa (Raddr )  -  UnitRaeord  -> 
URProcese 
<>  AuthProcesa) , 
n  11, 

NoResponde) ) ) ) 

& 

N"ComniandExpec  ted 
& 

(OoviceTupe (Raddr)  -  Uni tRecord  •> 

Kerne  I  Ca  1 1  ed  (Sendflessage  (URProcees) ) 
<>  Kernel  Cal  led  (Sendfleesage  (AuthProceee))) 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TH-6062/1 01/00 


transform  0pCat5 (Command!  CommandName) 

refcond  CofiimandExpected 
& 

Commands  Cat5 

effect  KernelCal I ocHKFcn (Command)) 

5 

N"Answers  -  Answers} . (ClockRead.KernelResul t) 

6 

N"CommandExpec  ted 


) 
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3.1.2  Operator  Process  (Formal)  TPI-6062/101/80 


transform  OpCatS (Command!  CommandName) 

refcond  CommandExpectod 
& 

Command<:Cat3  II  S”  (ACNT ^USERIDS) 

effect  N"PendingRcn<Joete  -  PendingRequeete  II 
S"  ( (NetiMr.c)l  d, 
flnpl.l'si’r  lei. 

Command, 

S" ( (AuthProcese.nl  I .NoResponse) ) ) ) 

& 

N"CommandExpec  ted 
& 

KernelCal led(Sendnessage(AuthProcess) ) 
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System  Development  Corporation 
TM-6062/101/08 


transform  0pCat7 (Command:  CommandName, 

Nkcpsi  set  of  ProceseName) 

refcond  Command  -  ACNT4JSERI0S 

affect  (Nkcpe<<«CurrentNkcps  •> 

fTPendlngRequaets  ■  PendlngRequeete  II 
S'*  UNewMegld, 

OpRaqueat, 

Command. 

S"RiReeponseSlot (E"PtProeeasName 
(PoNkcps 
8 

R  ■  (P.nl I .NoResponea) ) ) ) ) 

8 

N"CoinmandExpected 

8 

A”P:ProcessName(P<iNkeps  -> 

Kerne iCa  1 1 ed  (Sendflessage  (P) ) ) 

8 

NoError 

<>  Error 
8 

N"Pendincjnequeata  «  PendlngRequeete 
8 

N"CouimondExpocted) 
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3.1.2  Operator  Process  (Formal)  TH-60S2/101/00 


transform  OpCot 8a (Command:  CommandName) 

ra fcond  CommandExpectcd 
& 

Command  -  QUERY*-L0Gf1SG 

affect  N"Ansuera  ■  Answers: ,  (ClockRoad,f1akeStr!ng(Logf1essage)) 
& 

N"CommandExpected 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 


transform  0pCat8b (Command!  CommandNana) 

refccnd  CommandExpcctod 
& 

Command  »  SET4.0GMSG 

effect  NMAnsuer*  *  Answers* . (ClockRead.LogPrompt) 
N"CommandExpected  »  false 


21  flay  1975 

3.1,2  Operator  Process  (Pormal) 


System  Development  Corporation 
TH-6062/1 01/00 


transform  OpCotSc  IL I ned:  T”  J  i  in  taper  (1  <■  I  &  J  <•  S3) 
Line:  String)  ’ 

refcond  *Comment£xpected 

affect  NHCommanclGxpec  ted 

& 

in"L:LoyLinQ(t.<:Logl1e«*age  & 

L.Nuin  ■  Lined)  •> 

G"L:LocjLine(L<«Logl1estag*  & 

L.Num  ■  Lined 
5 

N"Logf1e«eage  »  Logflestage  S"(L)  II 
S" t (Lined. Line) ) ) 

<>  N  Logrtessage  •  LogMeeeege  II  SMtUnsd.Une))) 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TH-G062/1 81/08 


transform  0pCat9 (Command!  CammandNane) 

refcond  C:nmmandExpeetcd 

4 

Command  ■  QUERY«-ALL 

effect  N‘'Command£xpocted 
& 

N"PendintiRoquC3te  ■  PendlngRaqueets  II 
8" ((NowMsgld. 

Command, 

S" ( (Kcrno I .KernelResul t, Responded) , 
(AuthProcosn.nl  I .NoResponse) » 
(URProcete.  nl i , NoReeponee) ) ) ) 

& 

Kerne ICa I  led (KFcn (QUERY-S TORAGE) ) 

5 

Kernel Cal led (SendMeeeage(AuthProcess) ) 

4 

,<or ne  (Call  od  (Sendilessage  (URProcese) ) 
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System  Development  Corporation 
TH-60S2/101/00 


transform  OpCatlB (Command:  CommandName) 

refcond  CommandExpected 
& 

Command  -  SHUTOOUN 

effect  N"CommandGxpected 
& 

Kerne  I Ca  1 1  otl  (KFcn  (SHUTDOWN) ) 

& 

Kerne  I  Cal  I  ed  (Sendfleesage  (AuthProceee) ) 

8. 

Kerne  I  Cal  I  ed  (Sendfleesage  (URProceee) ) 

& 

Kerne  I  Cal  I  ed  (Sendfleeeaye  (AcntProceee) ) 
& 

A"PsProceesName(P<tCurrentNkcpe  -> 

Kerne  I  Cal ! ed (Sendtleeeage (P) ) ) 


21  Hay  1378  System  Oev«iopment  Corporation 

3.1.2  Operator  Process  (Formal)  TM-6062/1 01/00 


transform  AUTH1 (Nkcp:  ProcessName) 

effect  (NkcpcCut  sntNkcps  -> 

Error 

& 

N”CnrrentNkcps  «  CurrsntNkcps 
<>  Notrror 
8 

N"CurrcntNkcps  -  CurrsntNkcps  il  SMNkcp)) 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
Tfl -6062/101/00 


transform  AUTH2(Nkcps  ProcessName) 

effect  (NkcpcCurrentNkcps  -> 

Nolirror 

& 

N"CurrentNkcps  -  CurrentNkcps  ~~  S" (Nkcp) 
<>  Error 

& 

N"CurrentNkcps  -  CurrentNkcps) 
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3.1.2  Operator  Process  (Formal)  171-6062/101/00 


l 


transform  ProceosedRcsponse (P:  Pencil ngRequest, 

Text*  String, 

Sources  ProcsssName) 

refcond  P<iPendingReque9ts 
& 

P.Kind  -  OpRcquest 
& 

McnName (Text)  -  ResponseToOpRequeet 

e  f  fee  t  (E"Rs  Responses  I o  t (R<: P, Responses ■ 8 
R. Respondent  -  Source 
& 

R. State  *  NoResponse)  «> 

E"R: Responses  lot (R<iP. Responses  & 

R. Respondent  ■  Source 
& 

R. State  -  NoResponse 
& 

<E"Ri :Re9ponseSlot (RlcP. Responses  & 

Ri  R 
& 

Rl. State  »  NoResponse)  «•> 

N "Answers  ■  Answers 
& 

N"PsndingRequests  »  P end i ngRequest s  *»«-  S"  (P)  II 
SM((P.HsgId, 

P.Kind, 

P. Command, 

P. Responses  ~~  S”  CR)  II 
S”  ( (R. Respondent, 

Response (Text) , 

Responded) ) ) ) 

<>  N"PendingRequests  ■  Pend i ngRequest s  «**«  S"  (P) 

& 

N"Ansuers  -  Answers; .OpResponse (P) ) ) 

<>  Error) 


i 


I 

I 
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21  flay  1978  System  Development  Corporation 

3.1.2  Operator  Process  (Formal)  Tft-6062/1 01/00 


transform  ProcessedCommand(Text:  String) 

effect  (ComniandExpected  -> 

E"Coniniand!ComMandName (Command  -  CommandName (Text)  4 
(Commando  Cat0  ■> 

OpCat0 (Command) 

<>  CommondcCatl  ■> 

OpCatl (Command) 

<>  Commando  Cat2  «> 

0pCat2 (Command) 

<>  Conmiand<:Cat3  *> 

OpCatS (Command)  i 

<>  CommandoCat4  ■>  J 

0pCat4  (Command, Raddr  (Tf.xt) )  i 

<>  Commando  Cats  *>  ) 

OpCatS (Command) 

<>  Command  ■  ACNT«-USERIQS  ■> 

OpCatS  (Command) 

<>  Command  -  QUERY*-LQGf1SG  ■>  j 

QpCat8a(Command) 

<>  Command  -  SET*-L0Gf1SG  »> 

OpCatSb (Command) 

<>  Command  ■  QUERY»*ALL  -> 

0pCat9 (Command) 

<>  Command  ■  SHUTDOWN  ■> 

OpCatl 0 (Command) 

<>  Error) ) 

<>  OpCa  t8c  (L  i  nett  (Text )  ,Li  ne( Text) ) )  I 

£ 

\ 

i 

-i 

$ 


I 

1 

) 

i 


ill 


\ 

4 
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3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TH-S062/1 01/00 


transform  flsgNkcp  (Msgid:  fleseageld. 

Text:  String, 

Sources  ProcessName) 


refcond  Source  *»<:  TruetedProcesses  II 

S" ( lOPagingScheduler, 1 CSchedu I er , 
Ne tuorkProcees.OumpProcessor) 


effect 


(E"P:PendingRe>queat  (P<sPendinyRequesta  8 
P. Msg  Id  -  ttagld)  ■> 

E "P: Pend i ngReques  t (P<s  Pend  I ngRequee ts 
P.flsyld  ■  Msg  I  d 
8 

(P.Kiid  ■  OpRequest 
8 


8 


MsgName  (Text)  -  ReeponseToOpRequeet  -> 
ProcessedResponee (P, Text , Source) 

<>  Error) ) 

<>  0l8gName(Text)  -  OperatorRequeet  •> 

N"An3iiers  ■  Ansueraj .  (ClockRead.Text) 
<>  Error) ) 


21  Hay  1978 

3.1.2  Operator  Process  (Formal) 


System  Development  Corporation 
TPt— 6062/101/00 


transform  MsgUR (hsql cl?  Messageld, 

Text*  String, 

Sourcet  ProcessName) 

refcond  Source  *  URProcess 

affect  (E"P!PendinqRcque9t(P<:PendingRequests  4 
P.ttsgld  ■  flsgld)  -> 

E"P!PendingRequaet  (PcPendingRequeete  4 
P.Msgid  «•  (Isgld 
4 

(P.Kind  ■  OpRequeet 
4 

flsgNamedext)  "  Response ToOpRequeet  »> 
ProcessadResponsa(P, Text, Source) 

<>  Error) ) 

<>  (HsgName (Text)  ■  Opera torRequest  *> 

N"Ansuers  -  Answer s; . (ClockRead, Text) 
<>  Error ) ) 
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3.1.2  Operator  Proems  (Formal) 


System  Development  Corporation 
TM-G0G2/1 01/00 


transform  tteglOPS (Msg Ids  flesaageJd, 
Te>«ts  String, 

Sources  ProceeeNamr) 

rafeond  Source  *  lOPagingSchaduler 


affect 


(t  P:PendingRequest(P<:Pendlngflequeeta  £ 

r.nogld  «  May Id)  •> 

E "p  *  '  n0Requei  t  (P<»  Pend  i  ngRequea ts  £ 

r.ri3gld  ■  nag  I  cf 

5 

(P.Kind  ■  OpRequeet 
£ 


fl3gName(Text)  ■  ResponaeToOpRequest  ■> 
ProcaeeedReeponeetP, Text, Source) 

<>  Error)) 

<>  (nsgName(TeKt)  -  Opera torRequnst  »> 

N  Answers  -  Answers; . (ClockRlid, Text) 
<>  error) ) 
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3.1.2  Operator  Proems*  (Formal) 


System  Development  Corporation 

m-6062/iei/ee 


transform  MsglOSlMsgldt  hessageld. 

Texts  String, 

Sources  ProcessName) 

refcond  Source  ■  IOScheduler 

effect  (E  "Ps  Pend  i  ncjfleques  t  (P<  :Pend  ingRequaat  a  4 
P.flsgld  •  flsgld)  ■> 

E"Ps  Pend  i  ngRequaat  (PcPandi  ngRequeats  4 
P.flsgld  ■  hagld 
4 

(P.Kind  «  GpRaqueat 
4 

MsgNametText)  ■  ReeponseToOpReqiieat  »> 
PrucessedReaponae (P, Text, Source) 

<>  Error) ) 

<>  (MsgName ( Text)  -  OperatorRequeet  •> 

N"Ansi-iers  ■  Aneueraj .  (ClockRead.Text) 
<>  Error) ) 
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3.1.2  Operator  Process  (Formal) 


Sustain  Development  Corporation 

Trt-6062/iei/ee 


transform  f1ag0umo(flogld:  Mcsoageld, 

Text!  String, 

Sourcct  ProeeaaNama) 

refcond  Sourco  «  DumpProceaaor* 

affact  (EMPjPcndlngRequeBt(P<tPendlngRequeate  A 
P.hsgld  •  Nsgld)  -> 

E"PjPencringRaquaat  (PxiPendlngRequeeta  A 
P.Mogld  -  fltgld 
A 

(P.KInd  ■  OpRaquaat 
A 

rtorjNnmadaxt)  ■  RaaponaaToOpRaquaat  -> 
Pr oca a sedRaaponeatP, Text, Source) 

<>  Error ) ) 

<>  (MscjName (Text)  ■  OperatorRequaat  »> 

N"Ansuara  •  Aneuerat. (ClocKRaad, Text) 
<>  Error) ) 
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( 


transform  flsgAcnt  (flsgld:  flesesgeld, 

T*xli  String, 

Sourest  Pr oeeasName) 

refcond  Source  »  AcntProcess 

effect  (E"P:PendingRequest  (P<tPendingRequssts  4 
P.flsgld  -  flsgld)  ■> 

E"P:PandingRaquest (P<tPendlngRequests  4 
P. flsgld  •  flsgld 
4 

(P.Kind  »  OpReguest 
4 

flsgN.ime (Text)  -  Response ToOpRequest  ■> 
ProcessadResponsa  (P, Text , Source) 

<>  Error)) 

<>  (flsgName ( Text)  »  QperatorRequest  ■> 

N"An'iuers  •  Answerst .  (ClockRcad,  Text) 
<>  Error ) ) 
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Syatam  Qavalopmant  Corporation 

Trt-6e62/i8i/ee 


transform  NsgAuth (Msgld:  Nassagald, 

Taxtt  String, 

Sourest  ProcaaaNama) 

rafeond  Sourca  ■  AuthProcess 

affact  (E"P:Pandingnaquast  (PoPendlngRaquaats  4 
P.Msgld  •  Msgld)  «> 

E*P:PandlngRaqua*t (P<;PandingRaquaata  4 
P.Msgld  ■  Msgld 
4 

(P.Kind  ■  OpRaquest  •> 

(MagNama (Taxt)  ■  RaaponsaToOpRaquast  •> 

Pr ocassadRasponsa (P, Taxt , Sourca) 

<>  Error) 

<>  P.Kind  ■  MapUsarld  ■» 

(MsgNama(Taxt)  ■  MappadUaarld  »> 
(P.Command<:Cat3  ■> 

QpCat3(P. Command, Nkcpa(Taxt) ) 
<>  P.  Command  ■  ACNT«-USERIDS  »> 

0pCat7(P. Command, NKcpa (Taxt) ) 
<>  Error) 

<>  Error) 

<>  Error)) 

<>  (MogName(Text)  -  OparatorRaquast  -> 

N"Anauars  •  Ansuarat . (ClockRaad.Taxt) 
<>  MsgNome(Text)  -  AddNKcp  ■> 

AUTH1 (Nkcpa(Taxt) ) 

<>  MsgName (Text)  -  OelataNkcp  •> 
AUTH2(Nkcps(Taxt) )  . 

<>  Error) ) 
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transform  HsgNet (Hagldi  Hessageld, 

Twxlt  Siring, 

Sourcot  ProcessName) 

refcond  Source  ■  Ne tworkProcess 

effect  (E  "Pi  Pend  i  ncjRcquas  t  (P<j  Pend  IngRaqueets  4 
P.Manld  -  Msg Id)  «> 

EnP:PemiingRequest (P<tPendingRequeats  4 
P.Hsgld  ■  Hegld 

(P.Kind  •  OpRequeet 

(HygName (Text)  ■  ResponaeToQpRequeat  •> 
ProcascedResponsafP. Text, Source) 

<>  Error) 

<>  P.Kind  «  Print ?pHsg  ■> 

(HagName (Text)  •  QpHsgPr inted  »> 

(Answers  -nil  -> 

NTonsoleOutputState  •  Idle 
<>  KernelCal led(SendHeeaage( 
NetworkProcess) ) 

4 

N'ConsolaOutputState  -  Continuing 
4 

N"Ansuers  -  Answer et 2) 

<>  HagName (Text)  -  OpHitAttn  •> 

N " CommandExpec t  ed 

N"ConioleQutputState  -  Idle 
4 

KernelCal led (SendHessage (NetuorkProceee) ) 
<>  Error) 

<>  P.Kind  -  RoadOpRequest  «> 

(MsgName (Text)  »  QpRequestRead  -> 
ProeessedCommand(Text) 

4 

(CommandExpec  ted 
4 

ConsoleOutputState  •>  Idle 
4 

Answer*  nil  «> 

KernelCal I ed (SendHessage  ( 
NetuorkProcess) ) 

4 

N"Answers  -  Answers: 2 
4 

N"ConsoleOutputState  -  Continuing 
<>  N"Answers  >  Answers 
4 

N"ConsoleOutputState  « 

ConsoleOutputState) 
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System  Development  Corporation 
TM-6062/101/00 


( 


traneform  OpOr I ver ( InterruptTypei , 
IntsrpuptSubTypet , 
Msgldt  Meseageld, 
Textt  String, 

Sourest  FrocessNama) 


affect 


(InterruptType  ■  External  Interrupt  *> 

( Interrup tSubType  •>  Meeeage  ■> 

Kerne  I  Cal  led (Race  I vefleesage) 

0 

(Source  ■  AuthProcass  •> 

MegAuthdlsgld,  Text, Source) 

Source  ■  URProeess 

MsgUR  (Megld,  T<sxt,Souree) 

<>  Source  •  lOPaglngScheduler  •> 

MsgiOFS (Msg! d, Text , Source) 

<>  Stur-.e  ■  IOScheduler  «> 

.1egI0S((1sgId,  Text,  Source) 

<>  Source  -  NetuorkProeesa  »> 

MsgNet (tlsofd, Text, Source) 

<>  Tjource  ■  Oumprrocessor  ■> 

MsgOump(f1sgld,  Text,  Source) 

<>  Sources!  TrustedProcesoee  II 

S " ( I OPag I ngSchedu I er , I OSchedu I ar , 
NetuorkProcaas.DumpProceesor)  •> 
MsgNkcptMsgld, Text, Source) 

<>  Error) 

<>  Error) 

<>  Error) 

8 


KarnelCal  led  (Race)  ve!nterrupte) 

& 


Kerne  I Ca 1 1 ed (Re  I eaeeCPU) 
end  OpProceea 
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3.2.1s  Unit  Record  Process 
Informal  Description 

This  section  contains  the  informal  description  of  the  Unit  Record 
Process  of  KVF1/37B. 


Overview 

The  Unit  Record  Process  (URProcess)  performs  four  main  functional 

(1)  routes  readers  to  the  appropriate  NKCP  input 
spool  file  processor^ 

(2)  controls  the  allocation  of  printers  and  punches 
to  NKCP  output  spool  file  processors) 

(3)  processes  operator  commands  dealing  with  spool 
files  or  unit  record  devices)  and 

(4)  controls  the  allocation  of  ail  unit  record 
devices  and  tapes. 


Input  Spool  Files 

The  Unit  Record  Process  receives  an  external  interrupt  from  the 
Kernel  which  tells  the  Unit  Record  Process  that  a  particular  card 
reader  is  ready  to  transfer  card  images.  The  Unit  Record  Process 
initiates  a  single-card  read,  which  causes  the  identification  card 
to  be  read.  This  identification  card  contains  (at  least)  the 
security  level  of  the  information  in  the  file.  The  Unit  Record 
Process  attaches  the  device  to  the  appropriate  NKCP  and  sends  a 
message  to  the  NKCP  controlling  this  security  level,  notifying  the 
NKCP  that  an  input  file  awaits  spooling.  Uhen  the  NKCP's  input 
spool  file  processor  has  completed  the  transfer  it  notifies  the 
Unit  Record  Process,  which  in  turn  detaches  the  input  device. 


Output  Spool  Files 

Uhen  the  output  spool  file  processor  of  an  NKCP  wishes  to  print  or 
punch  a  (set  of)  spool  file(s),  it  sends  a  message  to  that  effect 
to  the  Unit  Record  Process,  which  in  turn  enters  the  NKCP  in  a 
list  of  NKCPs  awaiting  a  real  device.  Uhen  an  appropriate  device 
becomes  available,  the  Unit  Record  Process  causes  the  device  to  be 
readied  for  the  new  security  level  (possibly  by  the  operator, 
according  to  installation  policy),  attaches  the  device  to  the 
NKCP,  and  notifies  the  NKCP.  Uhen  the  NKCP  is  finished  with  the 
device,  it  notifies  the  Unit  Record  Process,  which  detaches  the 
device  from  the  NKCP.  The  Unit  Record  Process  then  marks  the 
device  as  available,  allowing  the  cycle  to  begin  anew. 
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Operator  Commands 


c?""nan‘j3  regarding  spool  files  or  unit  record  devices  are 
sent  by  the  Operator  Process  to  the  Uni  t  Record  Process  for 

theC*NKCPs'  NThusmISema|Ji0?  aS°Ut  !P°S'  fil”  lt  distributed  ?n 
xne  NNLrs.  inus  the  Unit  Record  Process  oroees*»« 

and"13^- 1*81  in?uW' th  Sp001  fil83  bW  sanding  messages  to  the  NKCPe 
and  auaiting  their  responses.  It  then  gathers  the  responses  and 
prepares  one  message  for  .the  Operator  Process,  which  Im  JaulS 
the  response  to  be  printed  on  the  operator’s  console? 


Each  operator  command  processed  by  the 
discussed  below.  Figures  1  through 
processing  cycles  of  the  unit  record  dev 


Unit  Record  Process  is 
three  display  the  various 
ices. 


t . 

f 


I . 


i 


i 
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non-spooling  uses 


Figura  1 


THE  HEADER  SPOOLING  CYCLE 
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Figure  2 

Printer  and  Punch 
Spooling  Cycles 
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SPOOLING  USES 

V 


START 


VARYOPPUNB 


varyonlineI 


drained, 

available 


not  spooling, 

DETACH 

pending 


- * - L _ . 

1 

NOT  AVAILABLE 
FOR  SPOOLING. 

j 

i 

notavaiiable 

OR  SPOOLING, 

attached  to 

USER 

OFFLINE 

[RELINQUISH 

DEVICE 

1 

— 

attach 


DETACH 


Figura  3 

NON-SPOOLING  CYCLES  FOR  ALL  UNIT  RECORD  DEVICES 
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Qparator  Commands 
sant  first  to  Unit  Record  Pr ocaas 


Command 


QUERY-UR 

QUERY*.  ALL 

QUERY-RADOR 

QUEF1V+TAPCS 

QUER Y-F  I  LES-USER  1 0 

QUERY-FILES-ALL 

OUERY-REAOER-USERID 

QUERv-READER-SPOQL  1 0 

QUERY-REAOER-ALl 

QUERY-PR  I  NTER-l SER 1 0 

OUERY-PR I NTER-GPOOL I Q 

QUERY-PR  1  NTER-ALL 

QUERY-PUNCM-USER  I D 

QUERY-PUNCH-SPQOL  1 0 

QUERY-PUNCH-ALL 

QUERY-HOLD 

SHUTOOUN 

BACKSPAC 

CHANGE-USERID 

CHANGE-S YS  TEM-CL ASS-ALL 

CHANGE-SYSTEh-SPOOL I 0 

DRAIN 

FLUSH 

FREE 

HOLD 

ORDER-USERID 

ORDER-SYSTEM 

PURGE-USE IIQ 

PURGE-SYSTEM 

REPEAT 

SPACE 

START 

TRANSFER 

ATTACH 

DETACH 

LOADBUF 

VARY 

LOCATE 


Cate¬ 

gory 


Both 

Both 

Both 

Both 

S 


See  command  description 
S  -  4 

S  U->N  3 

rt  -  2 

S  -  1 

See  command  description 
S  -  4 

S  U->N  3 

S  U->N  3 

S  U->N  3 

Both  -  6 

S  U->N  3 

Both  -  S 

S  -  4 

s  -  5 

See  command  description 
See  command  description 
See  command  description 
See  command  description 
See  command  description 
See  command  description 
S  -  7 


Destination(s) 


Attached  Processes 
Attached  Processes 
Attached  Processes 
Attached  Processes 
NKCP 

all  NKCPa 

NKCP 

NKCP 

all  NKCPa 

NKCP 

NKCP 

all  NKCPa 

NKCP 

NKCP 

all  NKCPa 
all  NKCPa 

Attached  Process 
NKCP 

all  NKCPa 
NKCP 

Attached  Process 

NKCr 

NKCP 

NKCP 

some  NKCPs 
NKCP 

some  NKCPs 
Attached  Process 
Attached  Process 


Attached  Process 
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Dedicated  Device  Attachment 

The  Unit  Record  Process  also  overseas  the  assignment  of  unit 
record  devices  and  tapes  in  nonsharable  status  to  VMs.  There  are 
two  ways  a  user  can  initiate  the  attachment  of  a  dedicated  device. 
At  logon  time,  the  Authorization  Process  Mill  automatical lg 
request  device  attachment  if  a  permanent  device  attachment  request 
exists  in  the  user’s  directory  entry.  The  user  may  also  request 
device  attachment  from  the  operator  who  will  send  the  request  on 
to  the  Unit  Record  Process.  In  either  case,  the  device  must  be 
available  for  assignment  (i.e.,  not  attached  to  some  other  process 
and  in  the  case  of  readers,  printers,  and  punches,  not  involved  in 
spooling  operations)  and  must  meat  securi ty  requirements.  The 
Unit  Record  Process  performs  the  attachment  if  it  can  and  notifies 
the  requesting  process  of  the  result.  (Further  details  can  be 
found  in  a  later  section.) 


(lore  on  Readers 

Each  reader’s  initial  stats  is  either  "Drained,  Available"  or 
"NotAvai lableForSpool ing,  OffLine,"  depending  on  the  systen 
configuration  information  provided  by  the  Authorization  Process. 

The  "Drained,  Available"  state  provides  the  link  between  the 
spooling  and  nonspooling  cycles:  to  be  employed  in  a  nonspooling 
capacity,  a  device  must  first  reach  this  stats.  For  example,  the 
DRAIN  command  must  be  issued  for  a  device  before  it  can  be 
attached  to  a  user,  or  varied  offline. 

A  device  can  be  entered  into  the  spooling  cycle  by  issuing  the 
START  command.  The  reader’s  associated  state  then  becomes 
"Started,  Available."  The  very  first  time  the  START  command  is 
issued,  a  list  of  file  classes  the  device  may  process  must  be 
provided. 


A  Ualk  Around  the  Reader  Spooling  Cycle 

The  operator  first  issues  the  START  command,  providing  a  list  of 
file  classes  which  the  reader  may  process. 

The  operator  then  loads  a  deck  of  cards  into  the  reader’s  hopper 
and  presses  the  read  button.  The  resulting  "Ready"  interrupt 
("Device  End")  causes  a  state  transition  from  "Started,  Available" 
to  "Started,  Secur i tyHeader" .  The  Unit  Record  Process  initiates  a 
card  read  operation  to  read  in  the  header  card  that  contains  the 
security  level  of  the  deck. 

The  interrupt  generated  by  the  end  of  the  card  causes  the  next 
state  change.  If  there  is  no  read  arror,  the  Unit  Record  Process 
attaches  the  device  to  the  NKCP  which  should  process  this  security 
level.  The  state  changes  to  "Started,  Spool ingForProcess. "  If 
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there  la  a  read  error,  the  Unit  Record  Process  notifies  the 
operator  that  physical  intervention  Is  required  by  sending  a 
message  to  the  Operator  Process.  The  Unit  Record  Process  then 
updates  its  state  information  for  this  reader  to  reflect  that  a 
wait  for  a  "Oevicj  Ready"  interrupt  is  necessary.  Upon  receipt  of 
this  interrupt  (caused  by  the  operator  again  pushing  the  read 
button),  the  Unit  Record  Process  reissues  its  request  for  Input  of 
the  header  card. 

If  the  appropriate  NKCP  does  not  currently  exist,  the  Unit  Record 
Process  asks  the  Authorization  Process  to  create  it.  The  state 
becomes  "Started,  At tachPonding. "  Uhen  the  reader  has  reached 
this  state,  further  processing  auaits  the  receipt  of  a  message 
from  the  Author ization  Process  stating  whether  or  not  the  NKCP  was 
created. 

jnee  the  reader  is  under  the  control  of  the  NKCP,  the  Unit  Record 
Procese  updates  the  status  of  the  reader  to  "Started, 
Spool ingForProcess. "  The  Unit  Record  Process  pays  no  more 
attention  to  the  reader  until  the  control  I Ing  NKCP  expl lei t ly 
requests  its  release. 

For  various  reasons  the  Unit  Record  Process  can  reject  the  request 
that  reader  be  attached  to  an  NKCP.  These  reasons  includet 

o  the  reader  is  not  cleared  to  read  this  deck 
(operator  error)}  or 

o  the  NKCP  which  should  read  this  deck  does  not 

currently  exist,  and  for  some  reason  the 
Authorization  Process  is  not  going  to  create  It. 

In  these  cases,  the  Unit  Record  Process  returns  the  device  to  the 
"Available"  state  and  sends  a  message  to  the  Operator  Process 
asking  ie  operator  to  physically  flush  the  deck  from  the  reader. 

If  the  attach  succeeds  and  the  card  deck  is  processed  by  some 
NKCP,  . »  Unit  Record  Process  will  next  receive  a  release  request 

from  the  NKCP.  At  this  point,  the  Unit  Record  Process  detaches 

the  device  from  the  NKCP,  and  updates  the  device  status  to 

"Started,  Available".  The  cycle  is  then  complete. 
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A  flora  Oatailad  Vi  on  of  Dadicatad  Oavica  Attachment 


At  logon,  tho  Authorization  Procasa  attempts  to  attach  to  the  new 
Vfl  each  of  the  dev i cos  listed  In  the  dedicated  device  section  of 
tho  directory  entry  for  the  user  logging  on.  (See  the  description 
of  tho  Authorization  Procoas  for  a  detailed  view  of  the  directory 
and  its  contents.)  If  the  device  being  requested  Is  either  a  unit 
record  device  or  a  tape  drive,  the  Authorization  Process,  after 
examining  tho  security  conditions  of  the  attachment,  requests  that 
the  actual  assignment  be  performed  by  the  Unit  Record  Process. 
The  Unit  Record  Procoss  determines  if  the  device  Is  available  (not 
attached  to  any  other  process,  and  If  a  unit  record  device, 
drained),  and  attachos  the  device  if.  it  can.  It  informs  the 
Authorization  Process  of  the  result.  The  Unit  Record  Procese  does 
not  directly  notify  the  NKCP,  since  the  Authorization  Process  will 
inform  the  NKCP  of  the  device  attachment  at  the  same  time  it  tells 
the  NKCP  about  the  new  Vfl. 

Uhen  the  NKCP  is  finished  with  the  device  (because  the  user 

Rer formed  an  explicit  detach  or  because  he  or  she  logged  off),  the 
KCP  is  expected  to  directly  notify  the  Unit  Record  Process  which 
will  update  Its  status  information  and  detach  the  device  from  the 
NKCP. 

The  other  method  of  attaching  a  device  for  nonsharable  use 
requires  that  the  user  send  a  message  to  the  system  operator  who 
decides  if  such  an  attachment  should  be  performed.  The  operator 
first  ensures  the  device  is  available  and/or  drained,  and  then 
types  the  operator  command  'Attach'  with  the  appropriate 
parameters.  If  the  device  is  a  unit  record  device  or  a  tape 
drive,  the  Operator  Process  reflects  the  message  to  the  Unit 
Record  Process.  The  Unit  Record  Process  determines  whether  the 
device  is  available  and/or  drained,  and  whether  or  not  the  proceae 
and  device  have  compatible  security  levels  given  the  requested 
access.  If  these  conditions  are  met,  the  Unit  Record  Process 
performs  the  attachment.  If  the  attachment  is  performed,  the  Unit 
Record  Process  informs  both  the  operator  and  the  affected  NKCP. 
If  it  cannot  be  performed,  the  Unit  Record  Process  informs  only 
the  operator.  If  the  operator  then  decides  that  the  device  is  not 
currently  assignable  to  the  NKCP,  it  is  up  to  him  or  her  to  so 
inform  the  NKCP.  Again,  when  the  NKCP  is  finished  with  the 
device,  it  directly  informs  the  Unit  Record  Process  which  releases 
the  assignment. 

In  summary,  dedicated  unit  record  or  tape  drive  device  attachment 
is  performed  either  at  logon  time  or  by  operator  request,  rather 
than  bu  the  user  directly  requesting  attachment  from  the  Unit 
Record  Process.  Houover,  device  detachment  is  directly  requested 
of  the  Unit  Record  Process. 
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OPERATOR  PROCESS 
-  Requests  - 


QUERY 


"Provide  status  information  on  the  real  or 
machine,  and  miscellaneous  CP  functions." 


virtual 


UR, 'ALL  -  for  e.ach  device  in  each  device  tablet 

if  device  is  currently  attached  to  NKCPt 
reflect  message  to  NKCP 
prepare  response  from  status  information 
and  NKCP  response 

el  set 

prepare  response  from  status  Information 


sand  response  to  Operator  Process 

rotldr  -  traddr  must  be  unit  record  device] 

if  device  is  currently  attached  to  NKCPt 
reflect  message  to  NKCP 
prepare  response  from  status  information 
and  NKCP  response 

el  set 

prepare  response  from  status  information 

3end  response  to  Operator  Process 

FILES  -  user  id  -  map  user  id  to  NKCP  Id 

reflect  message  to  NKCP 

send  NKCP  response  to  Operator  Process 

(ALU  -  reflect  message  to  each  NKCP 
gather  responses 
send  amalgamated  response 
to  Operator  Process 

READER,  PRINTER.  PUNCH  - 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
send  NKCP  response  tc  Operator  Process 

spool  id  -  (syntax  has  been  extended 
to  provide  NKCP  ids  along 
with  all  spool  ids] 


reflect  message  to  NKCP 
owning  spool  file 

send  NKCP  response  to  Operator  Proceee 
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(ALL!  -  reflect  message  to  each  NKCP 
gather  responses 
send  amalgamated  response 
to  Operator  Process 

HOLD  -  reflect  message  to  each  NKCP 
gather  responses 

send  amalgamated  response  to  Operator  Process 


BACKSPAC 


device  "  ^09*ar*  or  bdckspace  the  output  of  a  unit  record  spooling 


(device  must  be  printer  or  puncht 
must  be  assigned  to  Process] 

reflect  message  to  Process  owning  device 
send  Process  response  to  Operator  Process 


CHANGE 


"Alter  one  or  more  attributes  of  a  closed  spooled  file." 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
send  NKCP  response  to  Operator  Process 

SYSTEM  -  if  "CLASS"  or  "ALL"  specified: 

reflect  message  to  each  NKCP 
gather  responses, 
send  amalgamated  response 
to  Operator  Process 
else:  ispool  id  specified) 

(syntax  has  been  extended  to 
provide  NKCP  ids  along  with 
all  spool  ids! 

reflect  message  to  NKCP  owning  spool  file 
9end  NKCP  response  to  Operator  Process 


DRAIN 


current 


"Stop  spooling  activity  on  the  specif i 
files  in  operation  reach  termination." 


ed  devices  after 


the 


update  appropriate  device  table  entries 
reflect  message  to  each  Process 
owning  an  affected  device, 
if  no  message  has  already  been  sent 
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gather  responses 

send  amalgamated  response  to  Operator  Process 


FLUSH 

"Eliminate  and  halt  the  current  file  output  on  the 
specified  real  unit  record  device." 

[device  must  be  printer  or  puncht 
must  be  assigned  to  Process] 

reflect  message  to  Process  ounlng  device 
send  Process  response  to  Operator  Process 


FREE 

"Release  spool  HOLD  status  from  previously  held  files  for 
real  reader,  printer,  and  punch  devices. " 

map  user  id  to  NKCP  id 

reflect  messaqe  to  NKCP 

send  NKCP  response  to  Operator  Process 


HOLD 


"Defer  file  output  to  the  real  reader,  printer,  and  punch 
devices. " 


map  user  id  to  NKCP  id 

reflect  message  to  NKCP 

send  NKCP  response  to  Operator  Process 


ORDER 


"Redefine  the  order  of  closed  spool  files." 

user  id  -  map  user  id  to  NKCP  id 
reflect  message  to  NKCP 
send  NKCP  response  to  Operator  Process 

SYSTEM  -  determine  concerned  NKCPs 
reflect  message  to  each 
gather  responses 

9end  amalgamated  response  to  Operator  Process 


PURGE 
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"Remove  spooled  flle(s)  before  reading,  punching,  or 
printing, " 

user  Id  -  map  user  Id  to  NKCP  Id 
reflect  message  to  NKCP 
send  NKCP  response  to  Operator  Process 

SYSTEM  -  determine  concerned  NKCPs 
reflect  meeeage  to  each 
gather  responses 

send  amalgamated  response  to  Operator  Procees 


REPEAT 


"Add  to  the  number  of  copies  of  an  output  printer  or  punch 
file  on  a  real  unit  record  device." 

(raddr  must  be  a  printer  or  punch? 
must  be  assigned  to  an  NKCP] 

reflect  message  to  Procees  ounlng  device 
send  Process  response  to  Operator  Process 


SPACE 


"Force  single  space  on  the  printer,  regardless  of  carriage 
control  codes  contained  In  the  file." 

[raddr  must  be  a  pr inter i 
must  be  assigned  to  an  NKCP] 

reflect  message  to  Process  ounlng  device 
send  Process  response  to  Operator  Process 


START 


"Start  unit  record  devices,  or  restart  drained  devices,  or 
restart  and  change  output  classes  that  mag  be  serviced." 

update  appropriate  device  table  entry 
send  response  to  Operator  Process 


I 


TRANSFER 


"Direct  an  input  spool  file  to  or  retrieve  It  from  a 
specified  user's  virtual  card  reader." 

[syntax  has  boon  extended  to  provide  NKCP  ids 
along  uith  all  user  ids] 
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user  Id,  SYSTEM  spool  Id  - 

TO  user  id,  FROM  user  id  - 

if  source  NKCP  ■  destination  NKCPj 
reflect  message  to  source  NKCP 
3end  NKCP  respense  to  Operator  Procese 
el  set 

send  "Illegal"  massage  to  Operator  Procasa 
FROM  ALL  -  not  allowed  In  KVM/370 
SYSTEM  ALL  - 

TO  user  id  -  not  allowed  In  KVM/370 

FROM  user  id  -  (same  as  SYSTEM  spool  Id  FROM  user  id! 


ATTACH 

'% 

"Attach  a  real  device  to  a  virtual  machine  or  the  reel 

system. " 


[raddr  must  be  a  unit  record  device: 
device  must  be  in  a  DRAINED  state! 

Kerne  I  Call:  GrantAccess 

update  appropriate  device  table  entry 

send  response  to  Operator  Process 


DETACH 


"Remove  a  real  or  virtual  device  or  channel  from  a  virtual 
machine  or  the  real  system." 

[raddr  must  be  a  unit  record  device: 
device  must  be  in  a  DRAINED  etate! 

Ker ne I Ca II :  Re  I easeOev i ce 

update  appropriate  device  table  entry 

send  response  to  Operator  Procese 


LOAOBUF 


"Load  a  specified  train  image  into  either  the  1403 
universal  character  sot  buffer  or  the  3211  universal  character  set 
or  form  control  buffers." 

[raddr  must  be  a  printer  in  a  DRAINED  state! 

if  device  is  currently  attached  to  NKCP: 
reflect  mossage  to  NKCP 
send  NKCP  response  to  Operator  Process 
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:-y 


else: 

update  appropriate  device  table  entry 


VARY 

"A Mom  or  cl i sal  low  the  availability  of  a  device  to  the 
Vfl/370  control  program." 

raddr  -  [raddr  must  be  a  unit  record  device] 

,  update  appropriate  device  table  entry 

if  device  is  attached  to  Process,  notify  Process 

send  response  to  Operator  Process  i 

J 

•<] 

LOCATE 

"Provide  the  starting  location  of  the  user’s  CP  control 
blocks  or  (virtual  or  real)  devices." 

raddr  -  [raddr  must  be  a  unit  record  device? 
device  must  be  assigned  to  NKCP] 

reflect  message  to  NKCP  owning  device 
send  NKCP  response  to  Operator  Process 


O 
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Authorization  Process 
-  Responses  - 


AddedNkcp 
Cannot AddNkcp 
User JdMapped 


Authorization  Process 
-  Requests  - 


AttachOovice 

OeleteNkcp 


NKCP  Requasts 


A99lgnSpoolDevice 
Re  1 easeSpoo I Dev i ce 
OetachOevice 


NKCP  Responses 


ResponseToGpReques  t 
OetachOevice 
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3.2.2:  Unit  Record  Process 
Formal  Specification 


module  URProcess 
type 

Dev  I ceAddress, 

Char, 

String  -  list  of  Char. 

HarduareStatus, 

Message Id. 

ProcessName, 

Class, 

ResponseStatue  »  (NoResponse, Responded) , 

Re  (DevRequestStatus  -  (NoNeed.ShouldSend.Sent) , 

CommandName  -  ( QUER  Y*-UR-ALL ,  QUER Y-RADDR , 

OUERY-F  I LES-USER 1 0- ,  QUERY-F  I  LES-ALL . 

QUERY-ROPRPU-USER I D ,  QUERY-R0PRPU-SP00L  I D , 

QUERY-ROPRPU-ALL ,  QUERY-HOLD ,  B ACKSPAC .  CHANGE-USERID , 

D  IANGE-SYS  TEM.DRAIN,  FLUSH ,  FREE .  HOLD .  ORDER-USER  I D , 

OROER-S YS  TEM ,  PURGE-USER  I D ,  PURGE-S YS TEM .  REPEAT ,  SPACE , 
TRANSFER. LOCATE-RADDR) . 

RequestCategory  -  (OpRequest.MapUserld.NeedNkcp.Rel inqui shDevice) , 

I nputOev i ceStatus  -  (Secur i tyHeader.Secur i tyHeaderUai tForReady, 
AttachPending.AttachedToSpool ingProcess.Avai lable, 

A  t  tachedT oUsor , De  tachPend i ng, Of  fL i ne) , 

OutputDevi ceStatus  -  (Secur  i  tyHeader.Secur  i  tyHeaderUai  tforReady, 
AttachedToSpool i ngProcess, Secur i tyTrai ler, 

Secur  i  tyTra? lerUai tForReady, Avai lable, AttachedToUser, 

De tachPend i ng, Of  fLine) , 

TapeDr i veStatus  ■  (Avai lable, AttachedToUser, Of fLine, De tachPend ing) , 

Act  i  vi  tyStatus  -  (NotSpool ing, Drained, Started, Draining) , 

Spool  id  -  structure  of( 

Process  *  ProcessName, 

File  *  T" I : i nteger (0  <■  I  &  I  <«  999)), 

OORequestStatus  -  (Processing.Uai  tingForOevice) , 
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OutputOev i ceRequest  -  structure  of  ( 

Process  -  ProcessName, 

RequestedC  I  asses  *  set  of  Class. 

At tachedDev i ce  ■  DeviceAddress, 

State  -  OORequestStatus) , 

TapeOr I veEntry  -  structure  of  ( 

Raddr  -  DeviceAddress, 

State  •  TapeOr i veStatus, 

At tachedProcess  ■  ProcessName), 

ResponeeSlot  -  structure  of  ( 

Respondent  -  ProcessName, 

Text  ■  String. 

State  *  ResponseStatus) , 

PendingRequest  •  structure  of  ( 

Msgld  -  Message! d. 

Kina  «  RequestCategory, 

Command  -  CommandName, 

Responses  -  set  of  ResponseSlot) , 

ReaderEntry  ■  structure  of  ( 

Raddr  -  0cviccAddres3, 

State  ■  Act i vi tyStatus, 

CyclePosi tion  -  InputDeviceStatus, 

At tachedProcess  ■  ProcessName, 
ClassesServedCurrently  -  set  of  Class, 
ClassesServedNextCycle  -  set  of  Class, 

Channe IStatusUord  -  HarduareStatus, 

LineBuffer  ■  String), 

PrinterEntry  «  structure  of  ( 

Raddr  *  DeviceAddress, 

State  ■  Act ivi tyStatus, 

CyclePosi tion  -  OutputOev iceStatus, 

At tachedProccos  -  ProcessName, 
ClassesServedCurrently  -  set  of  Class, 
ClassesServedNextCycle  -  set  of  Class, 

Rel  inquishOev.ceRequestState  »  RelDevRequestStatus, 
Channe IStatusUord  *  HarduareStatus) , 

PunchEntry  -  structure  of  ( 

Raddr  -  Oov i ceAddress, 

State  ■  Act ivi tyStatus, 

Cyc lePosi t i on  -  OutputOeviceStatus, 

At tachedProcess  *  ProcessName, 

C I assesServedCurrent ly  -  set  of  Class, 
ClassesServedNextCycle  ■  set  of  Class, 

Re  I inqui shDeviceRequestState  ■  RelDevRequestStatus, 
Channe IStatusUord  ■  HarduareStatus) , 
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NkcpEntry  -  structure  of  ( 

Process  ■  ProcessName, 

Usab I  eReaders  -  set  of  OevicsAddress, 
UsablePr inters  ■  set  of  DeviceAddress. 
UsablePunches  -  set  of  OevicsAddress, 
UsableTapeOr ives  -  set  of  DeviceAddress) 


type 

ttessageLabel  -  (AddedNkcp.CannotAddNkcp.Userldttapped, 

AdclNkcp,  Oe  I  e  teNkcp,  A  t  tachOev  ice), 

DcviceTypes, 

KernelFunct ion, 

Ca  1 0  -  T"  (QUERY*-UR .  QUERY«-ALL ,  QUERY*-RADOR ,  QUERY*-TAPES ) , 

Catl  -  T "  (GUER  Y*-REA0ER*-SP00L I D , QUERY*-PR F NTER«-SPQOL ID, 

QUERY«-PUNCH*-SPOOL  I D ,  CHANGE *-SYSTEf1«-SP00L  10). 

Cat2  -  T "  (QUERY.-F  I  LES*-ALL ,  QUERY*-REAOERfALL ,  QUERY«-PR  I  NTER«-ALL , 
QUERY»-PUNCH*-ALL,  0UERY«-H0L0,  CHANGE*»5YSTEf1*-CLASS«-ALD , 

Cat 3  -  T"  (QUERY»-F I IES-USER 1 0 , QUERY«-REAOER«-USER 1 0 , QUERY.-PR I NTER«-USER I D , 
QUERY*-PUNCH«-USER  1 0 ,  CHANGE »4JSER  I D ,  FREE ,  HOLD ,  OROER^JSER  I D , 

PURGE ►USERIO) , 

Cat4  -  T" (BACKSPAC, FLUSH, REPEAT), 

Cats  -  T"  (0R0ER»-SYSTEf1,  PURGE  «-SYSTEF1) 
constant 

MsgName  (S  tr  i  ng)  sflessogeLabe  I , 

DeviceType (OevicsAddress) s0evicaTypa9, 

Raddr (String) : DeviceAddress, 

NeuMsg Ids  Message Id. 

SendMessage  (ProcessName)  s KernelFunct  ion, 

Oef  inedE I  seuhere: boolean  -  true, 

Nkcps(Str ing) t set  of  ProcessName, 

OpCmd (String) tCommandName, 

OpProcess.URProcess,  AuthProcess.AcntProcess.UpdaterProcess: 
ProcessName, 

TrustedProcesses  ■  S" (OpProcess.URProcess, AuthProcess, 
AcntProcess.UpdaterProcsss) 
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var i ab I e 

Shut t inyOoun:  boolean, 

Readers*  set  of  RenclerEntry, 

Printers:  set  of  Pr interEntry, 

Punche3t  sot  of  PunchEntry, 

TapeDrives:  set  of  TapeOr i veEntry, 

Pr  I  n  terSpoo  I  Requests:  set  of  QutputOeviceRequest, 
PunchSpoo  I  Requests:  set  of  DutputDevIceRequests, 
CurrentNkcps:  set  of  NkcpEntry, 

Pend  I  ngRequests:  set  of  PendingRequest 
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3.2.2  Unit  Record  Process  (Formal)  TH-6062/1BI/80 


initial 

PendingRequests  -  Empty 
4 

CurrentNkcps  •  Empty 

& 

Pr InterSpoolRequests  -  Empty 
4 

*Shutt ingOown 
<S 

A"R»ReaderEntry  (RcReadera  -> 

(R. State  -  Drained 
& 

R.CyclePosi t ion  •  Available 
& 

R.AttaxhedProcess  ■  URProceas 
& 

R.LineBuffer  -nil 
4 

R.ClassesServedCurrent ly  •»  Empty 
8 

R.ClassesServedNextCycle  •  Empty)) 

& 

A"P»PrinterEntry(P<Pr inters  -> 

(P. State  -  Drained 

8 

P.CycloPoei  tior.  -  URProcess 
<5 

P.AttachedProceee  -  URProcess 
& 

P.ClassesServedCurrently  •  Empty 
8 

P.Cla33esServedNextCycla  -  Empty 
8 

P.Rel inqui shOoviceRequestState  ■  NoNeed)) 

8 

A"P:PunchEntry  (Pc Punches  -> 

(P. State  -  Drained 
& 

P.CyclePosi tion  -  URProcess 
8 

P.  AttachedProcess  •  URProcess 
8 

P.ClassesServedCurrently  ■  Empty 
8 

P.CIassesServedNextCycle  -  Empty 
8 

P.Rel inqui shOeviceRequestState  »  NoNeed)) 

8 

A"T»  TapeDr i veEntry (Tc  TapeDr i ves  -> 

(T. State  •  Avai table 

8 

T. At tachedProcess  -  URProcess)) 


) 


) 
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i nvar i ant 

A"R1 ,R2»Reader£ntry (RleReaders  &  R2eReaders  -> 

(Rl.Raddr  ■  R2.Raddr  ->  R1  ■  R2) ) 

8 

A"Prl,Pr2tPr interEntry(PrlePr inters  4  Pr2ePrintera  -> 

(Prl.Raddr  •  Pr2.Raddr  ->  Prl  ■  Pr2) ) 

4 

A"Pul,Pu2»PunchEntry(PulePunches  4  Pu2ePunches  -> 

(Pul.Raddr  ■  Pu2.Raddr  ->  Pul  ■  Pu2)) 

4 

AMTi, T2s TapcDr i veEntry  (Tie TapeOr I vea  4  T2e  TapeOr  i  ves  -> 

(Tl.Raddr  -  T2.Raddr  ->  T1  -  T2) ) 

4 

A”R:ReaderEntry,  PrsPr interEntru,  PusPunchEntry,  T: TapeOr iveEnt^y 
(ReReaders  4  Pre  Printers  I  Pu<sPunches  4  TeTapeDrivea  -> 

(R.Raddr  **-  Pr.Raddr  4  R.Raddr  Pu.Raddr  4  R.Raddr  T.Raddr 
4 

Pr.Raddr  Pu.Raddr  4  Pr.Raddr  T.Raddr 

4 

Pu.Raddr  T.Raddr)) 

4 

A"R:ReaderEntry (R<: Readers  -> 

((R. State  »  NotSpooling  •> 

R . Cyc I ePos i t i one  S"  (A t  tachPend i ng, De tachPend I ng, 

A  t  tachedT  oUser , 0  f  f L i ne ) 

<>  R.CyclePosi  tioneS"  (Securi  tyHeader, 

Secur i tyHeaderWai tForReady, 

At tachPend ing, 

AttachedToSpool ingProcess.Avai table) ) 

4 

(R.CyclePosi t ion  -  Available  -> 

(R.ClassesServedCurrently  ■  R.CIaesesServedNextCycle 

4 

R. AttachedProcess  -  URProcess) ) ) ) 

4 

AMP:Pr  interEntry  (PePr  inters  -> 

( (P. State  ■  NotSpooling  «> 

P . Cyc I ePos i t i one  S "  (A  t  tachPend i ng. Oe tachPend i ng, 

AttachedToUser.Of fLine) 

<>  P.CyclePosi  tioneS"  (Securi  tyHeader, 

Securi tyHeaderWai tForReady, 

Securi tyTrai ler, 

Secur i tyTra i I erWa i tForReady, 
AttachedToSpool ingProcess, Avai table) ) 

4 

(P.CyclePosi tion  -  Available  -> 

(P.C l assesFsrvedCurrent ly  ■  P.CIassesServedNextCycle 
4 

P. Attach'  jcees  -  URProcess)))) 

4 

A"Ps PunchEntry (PePunches  -> 
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((P. State  -  NotSpoolinn  ■> 

P.C^.s  lePosi  t  ioncS"  (At  tachPcnding.OetachPendlng, 

_  _  ,  „  AttachedToUser.Of fLIne) 

o  P.CyclePosi tion<jS" (Secur i tyHeader , 

Secur l tyHeaderUai tForReady, 

Secur I tyTrai ler, 

Secur i tyTral I erUai tForReady, 
AttachedToSpool ingProcess.Aval table) 


P. C I aeeesServedNextCyc I e 


4 

(P.CyclePosi t ion  ■  Available  -> 

(P. C I assesServedCurrent ly 
4 

P. A t tachedProcess  ■  URProcess) ) ) ) 

"DR i  Outpu  tDev  i  ceReques  t  ( (0R<:  Pr  I  n  terSpoo  I  Requests 

r  .  2R<*punchSpoolRequeats)  *> 

(t  NsNkcpEntry (N<jCurrentNkcps  4 
N. Process  •  DR. Process) ) ) 

& 

A"N1 , N2: NkcpEntry  (N1  <:  CurrentNkcps  4  N2<iCurrentNkcps  -> 

(Nl. Process  -  N2. Process  ->  N1  -  N2) ) 

Q> 

A"N: NkcpEntry (NcCurren tiNkcps  -> 

(A"D:DeviceAddress 
( (DcN.UsableReaders  ■> 

E"R:RoaclerEntry{R<: Readers  4 
0  »  R.Raddr) 

<>  DcN.UsoblePr inters  •*> 

E"Pr:Pr interEntry (PrcPr inters  4 
0  «  Pr.Roddr) 

<>  DcN.UsablcPunches  »> 

E"Pu:PunchEntry  (PuoPunches  4 
0  -  Pu.Raddr) 

<>  OcN.Usnb loTapeOr ives  -> 

E"T:TnpeDriveEntry(T<:TapeDr ives  4 

0  ■  T.Raddr)}))) 

& 

A"Pl,P2:PendingRequest(Pl<:pQndingRequests  4  P2cPendingRequests  -> 
(PX.Msgld  -  P2.f1sgld  ->  PI  ■  P2) ) 

A  Pt  Pend  i  ngReques  t  (Pc  Pend  I  ngReques  ts  -> 

(A"R1  ,R2:RosponseSI ot  (RlcP.  Responses  4  R2cP.  Responses  -> 
(ni. Respondent  ■  R2. Respondent  ->  R1  ■  R2)))) 
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transform  KernelCal ledOOKernelFunction) 
effect  true 


145 


21  tlag  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TI1-G062/1B1/B8 


transform  RD(Raddr:  DeviceAddress) 

refcond  E"R:ReaderEntry (R<tReaders  8 
R.Raddr  «  Roddr) 

effect  E"RsRoaderEntrv)(R<jReadere  &  R.Raddr  ■  Raddr  & 

(R.StatecS"  (NotSpool  ing, Drained) 

I 

R.CycloPooi  tionoS"  (AttachPendlng.AttachedToSpool  IngProceae, 

A 1 1 achedToUser , De tachPend I ng, Of fL I ne)  •> 

Error 

<>  (R.CyclePoei tion  ■  Secur I tyHeader  -> 

(R.ChannalStatueUord.Uni tCheck  ■> 

R02b 
<>  R02a) 

<>  R.CyclePosI t ion  ■  Secur i tyHeaderUai tForReedy  ■> 
(R.Channe iStatusWord.Uni tCheck  »> 

RD2b 
<>  R02c) 

<>  R.CyclePosi tion  -  Available  ■» 

(Shu t t i ngOoun  ■> 

kerne  I  Cal  led(Sendt1essage(0pProcess) ) 

<>  R01 (Raddr) ) ) ) ) 
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transform  PR(Raddrt  OeviceAddreaa) 

refcond  E"P»Pr  interEntry(P<«Pr inters  8 
P.Raddr  ■  Raddr) 

effect  E"P«Pr interEntry(P<«Pr inters  8  P.Raddr  ■  Raddr  & 

(P.StatecS"  (NotSpool  ing, Drained) 

I 

P.Cycl ePoai t ion<«S" (AttachedToSpool ingProcaaa, 

A  t  taehedToUaer . Oe  tachPend I ng, Of  ft  I ne)  ■> 

Error 

<>  (P.CyclePoa ition  -  Secur I tyHaader  ■> 

(P.ChannalStatuaUord.Uni tCheck  ■> 

PR3b 
<>  PR3a) 

<>  P.CyclePoai  tion  ■  Secur  i  tyHoaderUa I  tForRjady  •*> 
(P.ChonnelStauaUord. Uni tCheck  ■> 

PR3b 
<>  PR3c) 

<>  P.CyclePoai tion  ■  Available  » 

(Pr intarSpoolRequeata  *»■  Empty 
& 

P. State  ■  Started 
8 

E " OR » Ou  t pu  tOe v 1 caReque a t (DR< » Pr i n  t erSpoo I Requee to  -> 
(DR. State  -  Ua I t i ngForDev I ce 
8 

P.CIaaaeaServedCurrently  88  DR.RequeatedClaseea 
«*■  Empty  -> 

PR2) ) ) 

<>  P.CyclePoai tion  -  Secur i tyTral ler  »> 

(P.ChannalStatuaUord.Uni tCheck  -> 

PRSb 
<>  PRSa) 

<>  P.CyclePoai tion  ■  Secur I tyTrai lerUai tForReady  ■> 
(P.ChannalStatuaUord.Uni tCheck  »> 

PRSb 

<>  PR5c) ) ) ) 


21  flag  1978  Syetem  Development  Corporation 

3.2.2  Unit  Record  Proceo*  (Formal)  TI1-60G2/101/08 


tranaform  PU(Raddrt  OevleeAddraee) 

refeond  EHPtPunchEntry (P<iPunehee  8 
P. Raddr  ■  Raddr) 

•ffact  EMPjPunchEntry (P<«Punchee  8  P. Raddr  ■  Raddr  8 
(P.StateoS"  (NotSpool  I ng, Drained) 

P.CyclePoal  tionoS"  (AttaehedToSpool  IngProeeea, 

At tachadToUaar , Da tachPend I ng, 0 f f L I na)  •> 

Error 

<>  (P.CgcloPoai tlon  ■  Sacur I tyHeadtr  ■> 

(P.CHannelStatueUord.Uni tCheck  •> 

PU3b 
<>  PU3a) 

<>  P.CgcloPoai  tlon  ■  Secur I tyHeaderUa I tForReadg  » 

(P.Chann  iStauaUord.Unl tChecK  ■> 

PU3b 
<>  PU3c) 

<>  P.CgclePoal tion  -  Available  «> 

(PunchSpoolRequaste  -»•  Empty 

8 

P. State  •  Started 

8 

E"DRtOutputDeviceRequest  (DRoPunchSpoolRaqueata  -> 
(OR. State  •  Uai t I ngForDev i ce 
8 

P.CIasaeeServadCurrent Ig  88  DR.RaqueatedClaasea 
Empty  -> 

PU2) ) ) 

<>  P.CgclePoai tion  ■  Secur I tyTrai ler  ■> 

(P.ChannalStatueUord.Uni tCheck  •> 

PUSb 

<>  PUSa)  . 

<>  P.CgclePoai  tlon  ■  Secur  i  tyTrai  I erUa I  tForReadg  •> 
(P.ChannalStatueUord.Uni tCheck  »> 

PUSb 

<>  PU5c) ) ) ) 


21  nag  1378  Sy.ttm  Development  Corporation 

3.2.2  Uni t  Record  Proceee  (Formal)  Tn-60BZ/10l/M 


S"  CP) 


transform  MegAuthdlscjId:  flassageld, 

Tnxt:  String, 

Source:  ProceaaName) 

refcond  Source  •  AuthProceaa 

affect  (E"P: Pend  I ngRequeet (P<: Pend  I ngRequeete  4 

P.flagld  •  Megtd)  ->  - ....  , 

(E"PiPendingRequeet(P<tPendingRequeate  4  P.negld  ■  negld  4 
(P.Kind  »  NeedNkcp  ■> 

(flsgName  (Text)  ■  AddNkcp  ■> 

R03a(Raddr (Text) ) 

£ 

N"PendingRequests  ■  PendlngRequeete  S"  (P) 
<>  MsgName(Text)  ■  CannotAddNkep  •> 

R03b (Raddr (Text) ) 

4 

N"Pend I ngRequaet a  -  PendingRequeate  —  S"  (P) 
<>  Error) 

<>  P.Kind  ■  flapUserld  •> 

(flsgName  (Text)  -  User  i  dflapped  -> 

(Nkcp(Text)  ■  nil  ■> 

Kerne ICal  led (Sendfleasage (OpProceaa) ) 

4 

N"PendingReque8te  -  PendlngRequeete 

~  SM  (P) 

<>  Kerne  I  Cal  led (SendHesaage (Nkcp (Text))) 

4 

N"PendlngRequeta  «  PendlngRequeete 
S" (P)  1 1 
S"  ( (Neuflagld. 

OpRequeet, 

QpCmd(Text) , 

S"(  (Nkcp (Text), 
nil, 

NoReeponae) ) ? ) ) 

<>  Error) 

<>  Error) ) ) 

<>  Ay  message  is  a  request,  not  a  response  ft/ 

(MsgNume (Text)  ■  AddNkcp  •> 

AUTH1 

<>  flsnName (Text)  ■  OeleteNkep  ■> 

AUTH2 

<>  TIsciNanm  (text)  ■  AttachOavica  ■> 

(QoviceType (Raddr vText) )  ■  Reader  ■> 

AUTH3a (Raddr (Text) ) 

<>  Oev iceType(Raddr (Text) )  ■  Printer  »> 

AUTH3b  (Raddr (Text) ) 

<>  DevlceTypa(Raddr (Text) )  ■  Punch  »> 

AUTH3c (Raddr (Text)) 

<>  Oev iceType (Raddr (Text) )  ■  TapeOrive  •> 

AUTH3d (Raddr (Text) I 


) 


21  Hay  1378 

3*2.2  Unit  Record  Process 


(Formal ) 


System  Development  Corporation 
TH-S062/101/00 


<>  Error) 
O'  Error ) ) 


■'  '  . .  '•*  •  '  ■  t r£&nx?.‘:r/.‘.f 


.  -awsitWKwi.-* 
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21  Hay  1973 

3.2.2  Unit  Record  Process 


System  Development  Corporation 
(Formal )  TN-6062/101/00 


transform  MsgOp  (flsgld:  dessageld. 

String, 

Source:  ProcessName) 

refcond  Source  »  AuthProcess 

effect  (E 'PsPendingRequest  (P<: PendingRequeats  & 

P. flsgld  •  llsgld)  -> 

Error 

<>  (flsgName(Text)<:Cat0  -> 

OP0(flsgName(Text) ) 

<>  flsgName(Text)<:Catl  -> 

0P1 (MsgName(Text) ) 

<>  flsgName(Text)<:Cat2  ■> 

QP2(flsgName(Text) ) 

<>  flsgName (Text) <:Cat3  ■> 

QP3  (flsgName(Text) ) 

<>  flsgName (Text) <:Cat4  ~> 

(Oev i ceType (Raddr (Text) )  -  Printer  «> 

0P4a 

<>  Devi ceType (Raddr (Text))  -  Punch  «> 
0P4b 

<>  Error) 

<>  MsqNama (Text)  -  SPACE  ■> 

(Dev i ceType (Raddr (Text) )  -  Printer  -> 

0P5 

<>  Error) 

<>  H3gNanic(Text)<:Cat6  «> 

0P6 (flsgName (Text) ) 

<>  flsqNome (Text)  -  L0CATE*-RAD0R  «> 

(Oev iceType (Raddr (Text) )  -  Reader  «> 
0P7a(fl3gName(Text) ) 

<>  Oev iceType (Raodr (Text) )  •  Printer  -> 
OP  7b 

<>  Dev iceType (Raddr (Text))  -  Punch  «> 

0P7c 

<>  Oev iceType (Raddr (Text))  -  TapeDrive  -> 
0P7d 
<>  Error) 

<>  flsgNnnie  (Tex  t)  -  SHUTDOWN  -> 

QP8 

<>  flsqName (Text)  -  VARY*OFFLINE  -> 

(Dev i ceType (Raddr (Text) )  -  Reader  -> 

0P9a 

<>  Oev iceType (Raddr (Text))  -  Printer  -> 
0P9b 

<>  OeviceType (Raddr (Text))  -  Punch  -> 

OPSc 

<>  Oev iceType (Raddr (Text))  -  TapeDrive  -> 
0P3d 
<>  Error) 

<>  flsqName (Text)  -  VARY.-ONLINE  -> 

(Oev iceType  (Raddr  (Text))  -  Reader  •> 


IS1 

/ 

V  > 


■i 

\ 

i 
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3.Z.Z  Unit  Record  Process  (Formal)  TM-606Z/1 01/00 


OP10a 

<>  Dev iceType(Raddr (Text))  -  Printer  -> 
OP  1Gb 

<>  OeviceTypa(Raddr (Text) )  -  Punch  •> 
OP10c 

<>  OeviceType(Raddr (Text) )  -  TapeOrive  -> 
OP10d 
<>  Error) 

<>  flscjName (Text)  -  ATTACH«-RA00R  •> 

(Dev iceType(Raddr (Text))  -  Reader  -> 

OPlla 

<>  Oev i ceType(Raddr (Text) )  -  Printer  «> 
OPllb 

<>  Oev iceType(Raddr (Text) )  -  Punch  •> 
OPllc 

<>  OeviceType(Raddr (Text) )  -  TapeOrive  -> 
OPlld 
<>  Error) 

<>  flsriNome (Text)  .  OETACH*-RADOR  •> 

(Dovi ceType (Raddr (Text) )  -  Reader  -> 

OP  12a 

<>  Oev i ceType (Raddr (Text))  -  Printer  -> 
0P12b 

<>  Oev i ceType (Raddr (Text) )  •  Punch  ■> 
QP12c 

<>  Devi ceType (Raddr (Text) )  -  TapeOrive  -> 
0P12d 
<>  Error) 

<>  HsrjNametText)  -  LOADBUF  -> 

(Dev i ceType (Raddr (Text) )  -  Printer  *> 

0P13 
<>  Error) 

<>  MeiiNnnte (Text)  •  ORAIN  -> 

(Devi ceType (Raddr (Text))  -  Reader  »> 

0P14a  ‘ 

<>  Dev i ceType (Raddr (Text) )  -  Printer 
OP  14b 

<>  Oev i ceType (Raddr (Text) )  «  Punch  -> 
0P14c 
<>  Error) 

<>  flsgNanie(Text)  •  START  »> 

(Devi ceType (Raddr (Text))  -  Reader  -> 

OPISa 

<>  Oev i ceType (Raddr (Text) )  -  Printer  -> 
OPISb 

<>  Oev i ceType (Raddr (Text) )  -  Punch  •> 

OPISc 
<>  Error) 

<>  flsgName(Text)  -  TRANSFER  ■> 

0P16 

<>  Error) ) 
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21  May  1978  Sy9tefn  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/1 81/80 


transform  MsgNkcp (Msg! d:  flessageld, 

Text:  String, 

Sourco:  ProcessName) 

reffcond  Source~<: TrustedProcesses 

effect  (£"P:PondingRequest  (PcPendingRequests  4 
P . (i 3 r| I d  =  Mogld)  •> 

(E"P  :P<?nd  I  ncjRcqueot  (PcPendingRequests  4  P.flsgld  ■  flsgld  4 
(P.Kind  «  OpRequest  ■> 

MsgName (Text)  -  ResponseToOpRequeet  ■> 

ProcessedResponae(P,Msgld, Source) 

<>  Error) 

<>  P.Kind  -  Rel inquishDevice  -> 

(MsgName(Text)  ■  DetachDevice  -> 

(Ofr/i ceType (Raddr (Text) )  ■  Reader  ■> 

NKCPla 

<s  Oev i ceTYpe (Raddr (Text) )  -Printer  -> 
NKCPlb 

<>  Oevi ceType {Raddr (Text) )  -  Punch  •> 

NKCPlc 

<>  Oev i ceType (Raddr (Text) )  -  TapeOrive  -> 
NKCPld 
<>  Error) 

<>  Error) 

<>  Error)) 

<>  /*  message  is  not  a  response,  but  a  request  #/ 

(MsgName (Text)  -  OetachSpoolOevice  -> 

(Dev i ceType (Raddr (Text) )  -Reader  -> 

R04 

<>  DeviceType(Raddr (Text) '  -  Printer  -> 

PR  4 

<>  OeviceType(Raddr (Text) )  -  Punch  -> 

PU4 

<>  Error) 

<>  MsgName (Text)  -  DetachDevice  -> 

(Ouv i ceType (Raddr (Text) )  -  Reader  -> 

NKCP2a 

<>  DeviceType(Raddr (Text) )  -  Printer  -> 

NKCP2b 

<>  Oevi ceType (Raddr ( text) )  -  Punch  •> 

NKCP2c 

<>  Oevi ceType (Haddr (Text) )  -  TapeOrive  -> 

NKCP2d 
<■*  Error) 

<■>  MsgName  (Text)  -  NeedSpool  ingDevice  -> 

(Oev iceTyoe (Raddr (Text) )  -  Printer  ■> 

PR1 

<>  Oev i ceType (Raddr (Text) )  -  Punch  -> 

PU1 

<>  Error) 

<>  Error)) 


|l-5»M2u  1n7?*  o  .  D  System  Development  Corporation 

3.Z.Z  Unit  Record  Process  (Formal)  TN-6062/1 81/00 


transform  URDr i ver ( InterruptTypet  , 
InterruptSubTupes  , 

Raddrs  DeviceAddress, 

Msgldj  Messageld, 

Taxt:  String, 

Source:  ProcessNama) 

effect  ( I nterruptType  ■  IOInterrupt  ■> 

(OeviceType(Raddr)  -  Reader  ■> 

RD  (Raddr) 

<>  IDevlceType(Raddr)  -  Printer  ■> 
PR (Raddr) 

<>  QeviceTupa (Raddr)  ■  Punch  -> 

PU (Raddr) 

<>  Error) 

<>  IntarruptType-  External  Interrupt  -> 

( InterruptSubType  -  flessage  -> 

Race i vedMessaga 

(Source  ■  AuthProcess  ■> 

flsgAuthdlsgld,  Text, Source) 
<>  Source  ■  QpProcess  ■> 

NegOpdlsgld,  Taxt, Source) 

<>  Sources:  TrustedProcesses  «> 
RsgNkcp  dlsgl d, Text , Source) 
<>  Error) 

<>  Error) 

<>  Error) 

& 

KernelCal led (Race i velnterrupts) 

& 

Kerne  I Ca 1 1  ad (Re  I easeCPU) 
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21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/101/08 


ROli  Unexpected  10  interrupt  signalling  deck  to  be  read 


transform  RDl(Raddrs  OeviceAddress) 

refcond  E"R«ReaderEntry  (RcReaders  8 

R.Raddr  ■  Raddr 
8 

R. State  ■  Started 
8 

R.CyclePosi tlon  ■  Available) 

8 

*•  ShuttingDoun 

effect  E"RjRoadcrEntry (RcReaders  8  R.Raddr  *■  Raddr  8 
N"Readers  ■  Readers  SH (R)  II 
S"(  (R.Raddr. 

R. State, 

/*##*/  Sccur  i  tyHeader, 

R. At  tachedProcess, 
R.CIassesServedCurrently, 

R. C I assesServedNextCyc I e, 

R . Channe I S  t a  tuaUor d, 

/ftWft/  nil)) 

8 

KernelCal led  (Request  10 (R.Raddr) ) ) 


21  flag  1378  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-60S2/101/00 


RD2a:  Expected  10  Interrupt  signalling  security  header  read 


transform  R02a(Raddrs  OcviceAddress, 

Process:  ProcassName) 

refcond  E"fl:ReaderEntry  (RcReaders  4 

R, Raddr  -  Raddr 
& 

R. State  —  NotSpooling 
4 

R.CyclePosi tion  ■  Secur i tyHeader 
4 

R.ChannelStatusUord.Uni tCheck  •  false 
4 

R.LineBuf far  nil) 

effect  E"R:ReaderEntry  (RcReaders  4  R. Raddr  »  Raddr  4 

(E"N:NkcpEn  try  (NcCurrentNkcps  4 
N. Process  -  Process)  -> 

E"N:NkcpEntry (NcCurrentNkcps  4  N. Process  -  Process  4 
N"Readers  ■  Readers  S" (R)  II 

S" ( (R. Raddr, 

/*//#*/  ( (A"0:0eviceAddrsss(DcN.U8ableReade'“s  ->  D  R. Raddr) 

I 

-GrantedAccess) 

4 

R. State  *  Oraining  •> 

Drained 
<>  R. State) , 

/iM*/  (E"D:DeviceAddress(DcN.UsableReaders  4  0  ■  R. Raddr) 

4 

GrantedAccess  ■> 

AttachedToSpool IngProcess 
Avd i (able) 

/*////*/  (E"D:0eviceAddress(0cN.UsableReader8  4  D  ■  R. Raddr) 

4 

GrantedAccess  »> 

N. Process 
<>  URProcess) , 

/*//#*/  (A"0:  Dev  iceAddressIDcN.Usab  I  eReaders  ->  D  -•  R.  Raddr) 

I 

-GrantedAccess  ■> 

R. C I assesSer vedNex tCyc I e 
<>  R.CIassesServedCurrent ly) , 

R. Cl assesSer vedNex tCyc I e, 

R. Channe I S ta tusUord, 

R.LineBuf fer) ) 


15G 
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System  Development  Corporation 
(Formal!  TM-S062/ 101/00 


(E"D:0evi ceAddross(D<: N.Usab I  eReaders  4  D  -  R.Raddr)  -> 
KernelCal ledtGrantAccess) 

4 

(GrantedAccess  ■> 

Kerne  I  Ca  1 1  td  (Sendfleeaage  (N.  Pr ocaaa) ) 

<>  Kerne  I  Ca  1 1  ad  (SendMessage  (QpProeeae) ) 

4 

(R. State  ■  Draining  ->  KernelCal led( 

SendMessage (OpProceee) ) ) ) 

<>  KernelCal I ed (SendMessage (OpProceee) ) 

4 

(R. State  ■  Draining  ->  KernelCal I ed ( 

SendMessage (OpProceee) ) ) ) ) 

<> 

N"Readers  ■  Readers  S" (R)  1 1 
S"( (R.Raddr. 

R. State, 

Avtf/W  At  tachPend  i  ng, 

fitUtt-tt/  Process, 

R.ClassesServedCurrent ly, 

R. C I assesServedNextCyc I e, 

R.ChannelStatusUord, 

R.LineBuf far) ) 

& 

Karne I Ca I  led (SendMessage (AuthPr ocess) ) ) ) 


21  Hag  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Format)  TM-6862/101/80 


R02b« 


) 


10  Error  when  attempting  security  header  read 


transform  R02b(Raddr:  DeviceAddress) 

refcond  E”RtReaderEntry  (RoReaders  & 

R.Raddr  •  Raddr 
& 

R. State  +>m  NotSpooling 
8 

R . Cyc I ePos i t I on< : S" (Secur i tyHeader , 

Secur i tgHeaderUai tForRsadg) 

& 

R.ChannelStatusUord.Uni tCheck  ■  true) 

effect  E"R:ReaderEntry  (RcReaders  &  R.Raddr  »  Raddr  & 

N"Reader9  »  Readers  S"(R)  II 
S"  ( (R.Raddr, 

R. State, 

/*//#*/  Secur  i  tgHeaderUai  tForReady, 

R . A  t  tachedProcess. 

R.C I assesServedCurrent ly, 

R.C I assesServedNextCyc le, 

R.  Channe iStatusUord, 

R.Li neBuf  fer) ) ) 

« 

Kerne  I Ca 1 1 ed (SendMessage (OpProcess) ) 


) 
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3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/181/80 


R02c»  Reader  error  cleared  by  operator  (10  interrupt  signalling 
device  ready) 


transform  RD2c(Raddr:  Dev i ceAddrsss) 

refcond  E"RtReader£ntry  (RoReaderi  & 

R.Raddr  ■  Raddr 
3 

R. State  NotSpooling 
& 

R.CyclePosi tlon  ■  Sscur i tyHeaderUai tForReady 
& 

R.ChannelStatusUord.Unl tChsck  -  false) 

effect  E"R:ReaderEntry  (RcRaaders  3  R.Raddr  ■  Raddr  3 
N"Readers  ■  Readers  S" (R)  1 1 
S" ( (R.Raddr, 

R. State, 

/>vMW  Secur  i  tyHeader, 

R. A  t  tachedProcese, 

R. C I aesasServedCurrent I y, 

R . C I assesSer vedNex tCyc I e, 

R.ChannelStatusUord, 

/*//#*/  nil)) 

& 

Kerne iCa I  I ed (RequestICHR. Raddr) ) ) 


153 
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21  flag  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-S0S2/1 81/00 


RD3at  AuthProceos  message  re  Nkcp  creation:  added 


transform  RQ3a(Raddr:  DeviceAddrees) 

refcond  E"R:ReaderEntpy  (RcReaders  4 

R.Raddr  ■  Raddr 
4 

E"N:NkcpEntry  (NcCurrentNkcps  4 

N. Process  ■  R. AttachedProcess) ) 

effect  E"R:ReaderEntry (RcReaders  4  R.Raddr  ■  Raddr  4 
(-(R. State  -■  NotSpooling 
4 

R.CyclePoel tion  ■  AttachPandlng) 

->  Error  <> 

E"N:NkcpEn try  (NcCurrentNkcps 
4 

N. Process  ■  R. AttachedProcess 
4 

N"Readers  -  Readers  -<*  S" (R)  II 
S" ( (R.Raddr, 

/*##*/  ( (A"0:0eviceAddrsss(0cN.UsableReaders  ->  0  —  R.Raddr) 

I 

-GrantedAccess) 

& 

R. State  ■  Oraining  -> 

Drained 
<>  R. Stats) , 

/*##*/  (E"0:  Dev  iceAddress  (DcN.Usab  I  eReaders  4  D  ■  R.Raddr) 

4 

GrantedAccess  «> 

AtttachedToSpool ingProcess 
«;>  Avai  I  able) , 

/*##*/  (A"0:DeviceAddress(0cN.UsableReaders  ->  D  -■  R.Raddr) 

I 

-GrantedAccess  ■> 

URProcess 

<>  R, AttachedProcess) , 

(A"0:OeviceAddress(D<:N.UsableReaders  ->  D  -■  R.Raddr) 

I 

-GrantedAccess  -> 

R.C I assesServedNextCyc I e 
<>  R.CIassesServedCurrently) , 

R.C I assesServedNextCyc I e, 

R.ChannelStatusUord, 

R. L i neBuf fer) ) 

& 


1S0 
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3.2.2  Unit  Record  Process 


System  Development  Corporation 
(Fop**I)  TM-6062/1 Bl/BB 


<S 


Kerne  I Ca 1 1  ad (SendMessag* (N, Process) ) 

(E"0! Dev iceAddr*as(0<jN.Us*b! eReader*  4  0  -  R.Raddr)  -» 
KernelCal led(GrantAecees) 

4 

(~Grant*dAec*s*  «> 

„  ■  ^  K.' ?rn^i.C* 1  f ad (SendWeeeeg* (OpProcese) ) ) 

<>  KernelCal  led(S*ndl1e9Sage(0pProc***)))))) 
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21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/1 81/00 


RD3bt  AuthPro.uise  message  re  Nkcp  creation:  cannot  add 


transform  R03b(Raddr:  OevicsAddress) 

refcond  E"R:ReoderEntry  (RcReaders  4 

R. Raddr  ■  Raddr) 

effect  E"R:ReaderEntry (RcReaders  &  R. Raddr  •  Raddr  & 
(—  (R. State  NotSpooling 
& 

R.CyclePoei tion  -  AttachPendlng) 

•>  Error  <> 

N"Readers  »  Readers  «*•  SH(R)  II 

S" ( (R. Raddr , 

/itUH*/  (R.  State  -  Ora  ini  ng  ■> 

□rained 
<>  R. State) , 

/■{tUUn/  Available, 

/*##*/  URProcess, 

/■itttU'h/  R.CIassesServedNextCycle, 

R. C I assesServedNextCyc I e, 
R.ChannelStatusUord, 

R.LineBuf fer) ) ) 

& 

Kerne  I Ca I  led (Sendflessage (OpProcess) ) ) 


*i£t' 
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R04t  Process  releases  reader  after  spooling 


transform  R04 {Raddr s  Devi ceAddrass, 

Request ingProcess:  ProcessName) 

refcond  E"RiReaderEntry  (RcRoaders  4 

R.Raddr  ■  Raddr) 

effect  EHR:RoaderEritry  (RcReaders  &  R.Raddr  ■  Raddr  & 

(••(R. State  -«■  NotSpooling 
& 

R.CyclePosi tion  ■  At tachedtoSpoo I IngProcess 

& 

R. AttachodProcess  ■  Request ingProcess) 

»>  Error  <> 

N"Readers  ■  Readers  «*.  S" (R)  I  I 
S"( (R.Raddr, 

/itUttit/  (QeviceReleased  &  R. State  »  Draining  ■> 

Drained 
<>  R. State) , 

/titfttit/  (OaviceReleased  •> 

Avai table 

<>  R.CyclePosi tion) , 

Av Utfa/  (Dev  i  ceRe  I  eased  »> 

URProcess 

<>  R. AttachsdProcesa) , 

R. C I assesServedCurrent I y , 

R. C I assesServedNextCyc I e, 

R.ChannelStatusUord. 

R.UneBuf  fer) ) 

& 

KernelCal led(ReleaseDevice) 

& 

(R. Stats  -  Draining  I  -.Device  Released  •> 

KernelCal  I  ed (Sendflessage (OpProcess) ) 

<>  KernelCal  I  ed  (Sendflessage  (R. At tachedProcess) ) ) ) ) 
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3.2.2  Unit  Record  Process  (Formal)  TM-S062/101/00 


OPIAat  Ora  in  (Reader) 


transform  0P14a(Raddr:  OeviceAddresa) 

refcond  E"R:ReaderEntry  (RcjReaders  4 

R.Raddr  «  Raddr) 

e.'fect  E"R:ReaderEntry  (RcReaders  4  R.Raddr  •  Raddr  4 
(R. State  *  NotSpooling 
■»  Error  <> 

N"fleaders  *  Readers  «•»»  S"  (R)  II 
SM(  (R.Raddr , 

/ itUUit/  (R.CyclePosi  tion  -  Available  ■> 

Drained 
<>  Draining) , 

R.CyclePosi  tion, 

R. A  t  tachedProcees, 

R.CiassesServedCurrent ly, 

R. C I assesServedNextCyc I e, 

R.Channe iStatusUord, 

R.LineBuf fer) ) 

4 

(R.CyclePosi t ion  -  Availably  -> 

Kerne  I Ca I  led (SendMessage (OpProcese) ) ) ) ) 


.*4»TeH4?‘  •* 


21  day  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  W-6062/1 01/00 


0P15a:  Start  (Reader) 


transform  0P15a (Raddr:  Dev i ceAddress, 

NeuC  lasses:  set  of  Class) 

refcond  E"R:ReaderEntry  (RcReaders  & 

R. Raddr  •  Raddr) 

effect  E“R:ReaderEntry  (RcReaders  &  R. Raddr  -  Raddr  & 
(R. State  *  NotSpooling 
■>  Error  <> 

N"Readers  ■  Readers  S"  (R)  II 
S"((R. Raddr, 

/*////*/  (NeuC I  asses  Empty 
I 

R.C I assesServedCurrent ly  Empty  -> 
Started 
<>  R. State), 

R. Cyc I ePosi t ion, 

R.AttachftdProcess, 

/*////*/  (NeuC lasses  Empty 

& 

R. Cyc I ePos i t i on  ■  Available  ■> 

NeuC I  asses 

<>  R. Cl assesServedCurrent I y) , 

/I'tltl*/  (NeuC  I  asses  Empty  •> 

NeuC I  asses 

<>  fl.C I assesServedNextCyc I e) , 
R.ChannelStatusUord, 

R.LineBuf fer) ) 

& 

Kerne  I  Ca  I  I  ed  (Sendflessage  (OpFrocess) ) ) ) 
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PRlt  Process  request  for  output  spooling  device  assignment 


transform  PR1 (Process:  ProcessName 

RequestedClasses:  set  of  Class) 

effect  (A"N:NkcpEntrq  (NcCurrentNkcps  -> 

N. Process  Process) 

I 

RequestedClasses  -  Empty 
->  Error  <> 

N"Pr i nterSpoolRequests  - 
(~Shutt i ngDoun  -> 

Pr I n  terSpoo I  Requests  II 
fi"  t  (Process, 

RequestedClasses, 
n  i  I , 

Ua i t i ngForOev i ce) ) 

<>  Pr interSpoo IRequests) ) 
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3.2.2  Unit  Record  Process  (Formal)  TM-6062/101/00 


PR2:  Printer  Assignment  (for  spooling) 


transform  PR2(0R:  QutputDeviceRequest, 

P:  Pr i nterEntry) 

refcond  DRcPr interSpoolRequests 
& 

PcPr  inters 
& 

P. State  -  Started 
4 

P.Cyc I ePosi t i on  ■  Available 
& 

DR. State  ■  Uai tingForOevice 
4 

C I assesMa  tch (P. C I assesSer vedCurrent I y, 

□R.RequestedC lasses) 

4 

E"N:NkcpEntry (NcCurrentNkcpe  4 
M. Process  ■  0R.°rocess) 

effect  E"P:Pr interEntry(P<:Pr inters  4  P.Raddr  ■  Raddr  4 

(E"N:NkcpEntry  (NoCurrentNkcps  4  N. Process  »  DR. Process  4 
N"Pr inters  -  Printers  ~~  S" (P)  II 
SM(  (P.Raddr, 

P. State, 

/'itUU'iJ  (E"D:DeviceAddress(D<:N.UsablePr inters  4  D  •  P.Rr^dr-)  •> 
Secur i tyHeader 
<>  P.Cyc I ePosi t ion) , 

/%'iUff-tt/  (E"D: Dev iceAddress  (DcN.Usab I ePr inters  4  D  ■  P.Raddr)  -> 

OR. Process 

<>  P. AttachedProcess) , 

P.C I asscsServedCurrent ly, 

P.C I assesServedNextCyc I e, 

P.Rol inqui shOeviceRequestState, 

P.ChannelStatusUord) ) 

4 

N"Pr interSpoolRequests  ■  PrinterSpoolRequests  ~~  S" (DR)  II 
S" ( (OR. Process, 

OR.RequestedClasses, 

(E"0:DeviceAddress(D<:N.UsablePrinters  4  D  •  P.Raddr)  •> 
P.Raddr 

<>  DR. At tachedOevice) 

/itffUit/  (E"D:DeviceAddress(D<:N.UsablePrintsrs  4  D  »  P.Raddr)  ■> 
Processing 
<>  OR. State) ) ) 

4 

Korne ICa I  I ed (Request  10 (P.Raddr) ) ) ) ) 
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3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/101/00 

) 

PR3a:  Interrupt  indicating  end  of  security  header  output  on 

pr inter 


transform  PR3a(Raddr:  OeviceAddrese) 

refcond  E"P?Pr interEntry  (PcPr inters  & 

P.Raddr  ■  Raddr 
& 

P. State  NotSpooling 
& 

P.CyclePosi tion  ■  Secur i tyHeader 
& 

P.ChannelStatusUord.Uni tCheck  ■false) 

effect  E"P:PrinterEntry(P<:Printers  &  P.Raddr  ■  Raddr  S 
N"Pr  inters  *  Printers  <***  S"  (P)  II 
SM ( (P.Raddr, 

P. State, 

/*##*/  (GrantedAccess  ■> 

At tachedToSpoo I ingProcess 
<■>  Secur  i  tyTrai  ler) , 

P. A t tachedProcess. 

P.C I assesServedCurrent ly, 

P.C I assesServedNextCycle,  ' 

/*//#*/  (GrantedAccess 

& 

P. Rel i nqui sHOeviceRequestState  -  ShouldSend  ■> 

Sent 

<>  P.Rel inqui shOeviceRequestState) , 

P.ChannelStatusUord) ) 

& 

(GrantedAccess  ■> 

KernelCal  I  ed(Sendf1essage(P.  At  tachedProcess) ) 

& 

(P.Rel inqui shOeviceRequestState  ■  ShouldSend  -> 

KernelCal  I  ed  (Sendflessage  (P.  At  tachedProcess) ) ) 
<>  KernelCal led (Request  10 (P. Raddr) )) ) 


) 
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PR3bi  Interrupt,  !0  error  on  attempt  to  output  security  header 


transform  PR3b(Raddr:  OeviceAddress) 

refcond  EMPiPr InterEntry  (PoPrinters  & 

P.Raddr  »  Raddr 
& 

P. State  NotSpooling 
& 

P.CyclePos i t ionciS" (Secur i tyHeader , 

Secur i tyHeaderUai tForReady) 

& 

P.ChannelStatueUord.Uni  tCheck.  •  true) 

effect  E"P:Pr interEntry  (PcPrinters  &  P.Raddr  •  Raddr  & 

N''Pr  inters  ■  Printers  S"  (P)  II 
S"  ( (P.Raddr, 

P. State. 

/*##*/  Secur i tyHeaderUai tForReady, 

P. A  t  tachedProcess, 

P. C I assesServedCurrent I y, 

P .  C 1 .13  sesSer  vedNex  tCyc  I  e . 

P.Ral inqui ahOeviceRequeetState, 
P.ChannelStatusUord) ) 

& 

Kerne  ICal  I  ed (Sendflessage (OpProcess) ) ) 
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3.2.2  Unit  Record  Process  (Formal)  TM-S0G2/101/00 


PR3ci  Interrupt  indicating  OK  to  retry  security  header  output 


transform  PR3c (Raddr:  OeviceAddress) 

refcond  E"P:Pr interEntry  (PcPrinters  & 

P.Raddr  ■  Raddr 
& 

P. State  NotSpooling 
3 

P.CyclePosi t ion  ■  Securi tyHeaderUai tForReady 
& 

P.ChannelStatusUord.Uni tCheck  »  false) 

effect  E"P*.Pr intcrEntry(P<tPrintar9  &  P.Raddr  •  Raddr  & 

N"Pr inters  «  Printers  SM(P)  II 
S" ( (P.Raddr, 

P. State, 

/*##*/  Secur i tyHoader, 

P . A  t  tachedProcess, 

P.CIaesesServedCurrently, 

P. C I assesServedNextCyc I e, 

P.Rel i nqui shDevicsRequestState, 
P.ChannelStatusUord) ) 

& 

KernelCal led (Request  10 (P.Raddr) ) ) 


.  •  '-t*-.-*  imvx.-^hy 


q  __  ,_  System  Development  Corporation 

3-2.2  Unit  Record  Process  (Formal)  Tn-6062/101/00 


PR4j  Process  message,  release  output  spooling  device 


transform  PRPU4 {Raddr:  DeviceAddress, 

ProcR3s:  ProcesaName) 

effect  E"P: Pr i nterEn try (P<tPr inters  &  P.Raddr  -  Raddr  & 

(~(E"P:Pr interEntry  (PoPrinters  & 

P.Raddr  ■  Raddr 
& 

P. State  «<■  NotSpool  ing 

P.Cyc I ePosi t ion  »  AttachedToSpool ingProceee 
<S 

P. At tachedProcess  -  Process 

6 

F'’OR:  Ou  tpu  tOev  i  ceReques  t  (t)R<:  Pr  i  nterSpoo  I  Requests  & 

OR. Process  »  P. At tachedProcess 
& 

DR. State  ■  Processing 
& 

DR. AttachedOevice  ■  P.Raddr))) 

»>  Error  <> 

N"Pr  inters  *  Printers  <*«*»  S"  (P)  II 
S"(  (P.Raddr, 

P. State, 

/tittttit/  Sectiri  tyTrai  ler, 

/*////-!>/  URProcess, 

P.ClassesServedCurrent ly, 

P. C I assesServedNextCyc I e, 

P.Rel i nqu i shOev i ceReques  tS  ta te, 

P.ChannelStatusUord) ) 

& 

E"DRj Ou tputOev i ceReques t  (DRcPr  i nterSpoo IRequeats  4 
DR. Process  »  P. At tachedProcess 

DR. State  ■  Processing 

6 

OR. AttachedOevice  -  P.Raddr 
4 

N"Pr interSpoolRequests  ■ 

Pr interSpoolRequests  *«.S"(QR)) 

& 

KernelCal led(RequestIO(P. Raddr) ) ) ) 


*■  -Vfr 


n  —  System  Development  Corporation 

Unit  Record  Process  (Formal)  7)1-6062/101/08 


PR5as  Interrupt  indicating  successful  completion  of 
trailer 


> 


secur 1 ty 


transform  PRSa (Raddr s  Dev i ceAddress) 


refcond  E"PsPr InterEntry (P<jPr Inters  & 

P. Raddr  ■  Raddr 
& 

P. State  <*■  NotSpooling 
& 

P.CyclePosi ticn  ■  Secur i tyTrai ler 
& 

P.ChannelStatusUord.Uni tCheck  -  false) 


effect  E"P:Pr in terEn try (P<: Printers  &  P. Raddr  -  Raddr  & 
N"Pr inters  ■  Printers  S"  (P)  II 
SM((P. Raddr, 

/*////*/  (P. State  •  Draining  ■> 

Drained 
<>  P. State), 

/*////*/  Available, 

P. A  t  tachedProcess, 

/  *0#>v/  P.ClassesServedNextCycle, 

P.ClassesServedNextCycle, 

Av/W*/  NoNeed, 

P.ChannelStatusUord) ) ) 
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3.2.2  Unit  Record  Process  (Formal)  TM-6062/1 01/00 


PRSbJ  Interrupt.  10  error  on  security  trailer  output 


transform  PRSb (Raddr!  OeviceAdcJresa) 

refcond  E"P:Pr InterEntry  (PcPrintera  & 

P. Raddr  ■  Raddr 
6 

P.  State  NotSpooling 
& 

P.CyclePosi t ion<jS“ (Secur i tyTrai ler, 

Secur i tyTra i I erUa i tForReady) 

& 

P.ChannelStatusWord.Uni tCheck  ■  true) 

effect  E"P:Pr interEntry  (PcPr inters  &  P. Raddr  •  Raddr  & 

N"Pr  inters  *  Printers  **«•  S"  (P)  II 
S" ( «P. Raddr. 

P. S  tate, 

/*//#>>/  Secur  i  tyTrai  lerUai  tForReady, 

P. A  t  tachedProceas, 

P. C l assesServedCurrent I y, 

P.Cl aaseaServedNextCycl e, 

P . R  e  M  nqu i shOe  v i ceReque  s  t  S  t  a  t  e , 

P.ChannelStatuaUord) ) 

8 

KernelCal I ed (SendMeasage (OpProceaa) ) ) 


21  May  1978  System  Oevalopmant  Corporation 
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PRSct  Interrupt,  OK  to  retry  security  trailer  output 


transform  PR5c(Raddrt  OeviceAddress) 

refcond  E"PiPr InterEntry  (PcPrinters  8 

P.Raddr  ■  Raddr 
& 

P. State  <*•  NotSpool  ing 
8 

P.Cycl ePosi t ion  ■  Secur i tyTrai lerUai tForReady 
8 

P.ChannelStatuaUord.Uni tCheck  •  falsa) 

effect  E"P:Pr interEntry (PcPrinters  8  P.Raddr  «  Raddr  8 
N"Pr inters  *  Printers  ~~  S"  (P)  II 
S" ( (P.Raddr, 

P. State, 

Secur  i  tyTrai  ler, 

P. A  t  tachedProcess, 

P. C I assesServedCurrent I y, 

P. C I aasesServedNextCyc la, 

P.Ral inqul shOevIceRequestState, 
P.ChannelStatusUord) ) 

8 

KernelCal led (Request  10 (P.Raddr) ) ) 
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System  Development  Corporation 
{For,nali  TN-6062/101/00 


PUIj  Process  request  for  output  spool ing  device  assignment 


transform  PU1 (Process:  ProcessName 

RoquestedClasses:  set  of  Class) 

effect  (A"N:NkcpEntry  (NcCurrentNkcps  -> 

^  N. Process  Process) 

RequestedClasses  ■  Empty 
->  Error  <> 

N"PunchSpoo IRcquests  ■ 

(■vShut  t  i  ngOown  ■:» 

PunchSpoo I  Requests  II 
S"  ( (Process, 

RoquestedClasses, 

nil, 

Uo i t i ngForQev i ce) ) 

<>  PunchSpoolRequests) ) 


21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Ttt-6062/181/08 


) 

PU2j  Punch  Assignment  (for  spooling) 


transform  PU2(0R:  OutputDevlceRequest, 

P:  PunchEntry) 

refcond  ORcPunchSpoo  iRoquests 
& 

P<: Punches 
4 

P. State  ■  Started 
4 

P.Cyc'ePosi tion  -  Available 
4 

DR. State  -  Uai t ingForDeviee 
8 

Cl  asgeollatchtP.r'assesServedCurrent  ly, 

OR. Requss tedC I  asses) 

4 

E"N:NkcpEntry  (NcCurrentNkcps  4 
N. Process  ■  OR. Process) 

effect  E"PiPunchEntry  (PcPunches  4  P.Raddr  -  Raddr  4 

(E"N:NkcpEntry  (NoCurrentNkcps  4  N. Process  -  DR. Process  & 
N"Punches  -  Punches  S"  (P)  1 1 
S"  UP.Ratklr, 

P. State.  /" 

(E"0:OeviceAddress(D<jN.UsablePunchee  4  D  -  P.Raddr)  ■» 
Secur i tuHeader 
<>  P.Cyclerosi tlon) . 

/itUttit/  (E"DsDeviceAddress(D<!N.UsablaPunches  4  0  -  P.Raddr)  -> 

DR. Process 

<>  P.AttachedProcess) , 

P.CI assesServedCurrent ly, 

P. C I assesServedNextCyc I e, 

P.Ral inqui shDeviceRequestState, 

P.Channe IStatusUord) ) 

4 

N"PunchSpoo  lReque9ts  ■  PunchSpoo  I  Requests  ~~  S"  (DR)  II 
S" ( (OR. Process, 

OR.RequestedC I  asses, 

/*////*/  (E"Q;DeviceAddress(D<:N.UsablePunches  4  D  -  P.Raddr)  ■> 
P.Raddr 

<>  DR.AttachedDevice) 

/itftttit/  (E"D:DeviceAddress(D<!N.UsablePunches  4  D  »  P.Raddr)  »> 
Processing 
<>  DR. State) ) ) 

4 

KernelCal led(RequestIO(P. Raddr) ))) ) 
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1  flay  1978  System  Development  Corporation 

.2.2  Unit  Record  Process  {Formal)  Tfl-6062/101/00 


PU3at  Interrupt  indicating  end  of  security  header  output  on  punch 


transform  PU3a (Raddr i  DeviceAddress) 

refcond  E"PiPunchEntry  (P<sPunches  5 

P.Raddr  ■  Raddr 
& 

P. State  *»«  NotSpooling 
& 

P.CyclePoel t ion  ■  Secur i tyHeader 
4 

P.ChannelStetueUord.Uni tCheck  -  false) 

effect  E"P:PunchEntry  (PcPunches  4  P.Raddr  »  Raddr  4 
N"Punche5  ■  Punches  S" (P)  1 1 
S"  ( (P.Poddr, 

P. State, 

(GrnntedAcceas  ■> 

At tachedToSoool ingProcass 
<>  Secur i tgTrai I er) , 

P. A  t  tachedProcess, 

P.C l assesServedCurrent ly, 

P. C l aesesSarvedNextCyc I e, 

/*##*/  (GrantedAccess 
4 

P.Rel inqui shOeviceRequestState  »  ShouldSend  ■> 

Sent 

<>  P.Rel inqui shOeviceRequestState) , 

P.ChannelStatusUord) ) 

4 

(GrantedAccess  ■> 

Kerne  I  Cal  I edISendflessage (P. At tachedProcess) ) 

4 

(P.Rel inqui shOeviceRequestState  -  ShouldSend  -> 

KerneICa!  led(Sendflessage(P.AttachedProcess) ) ) 
<>  KernelCai led (Request  10 (P.Raddr) ) )) 
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3.2.2  Unit  Record  Process  (Formal)  TM-G062/1 01/00 


PU3b:  Interrupt.  !0  error  on  attempt  to  output  security  header 


transform  PU3b(Raddr:  DeviceAddress) 

refcond  E"P;PunchEntry  (P<sPunchee  & 

P.Raddr  ■  Raddr 
A 

P. State  NotSpooiing 
A 

P.  Cyc  I  ePosi  t  ioncS"  (Secur  i  tyHeader, 

Secur i tyHeaderU* i tForReady) 
A 

P. Channe IStatusUord.Uni tCheck  ■  true) 

effect  E"P:PurichEntry (P<: Punches  A  P.Raddr  *  Raddr  & 

N"Punches  -  Punches  ~~  S" (P)  I  I 
3" ( (P.Raddr, 

P. State, 

•v/  Secur  i  tyHeaderMa  i  tForReady, 

P. A  t  tachedProcess, 

P. C I assesServedCurrent ly, 

P.Ci assesServsdNextCycle, 

P.Rel inqui shOeviceRequestState, 
P.ChannelStatusUord) ) 

A 

Kerne  I Ca I  led (Sendflessage  (0pProce9s) ) ) 


21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/101/00 


PU3c:  Interrupt  indicating  OK  to  retry  security  header  output 


transform  PU3c(Raddr:  DeviceAddress) 

refcond  E"P:PunchEntry  (PcPunches  & 

P. Raddr  ■  Raddr 
& 

P. State  NotSpool  ing 

4 

P.Cyc I ePosi t ion  *  Secur i tyHeaderUai tForReady 

5 

P.ChannelStatusUord.Uni tCheck  -  false) 

effect  E"P:PunchEntry (PcPunches  4  P. Raddr  ■  Raddr  4 
N"Punches  -  Punches  — .  S"(P)  II 
S" ( (P. Raddr. 

P.  S  tate. 

/*////*/  Secur i tyHeader, 

P. A  t  tachedProcess, 

P. C I assesServedCurrent I y. 

P. C I assesServedNextCyc I e, 

P.Rel inquishOeviceRequestState, 
P.ChannelStatusUord) ) 

4 

Kerne  I  Cal  I ed (Request  10 (P. Raddr) ) ) 
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PUA:  Process  message,  release  output  spooling  device 


transform  PU4 (Raddr:  DeviceAddress, 

Process:  ProcessName) 

effect  E"P: PunchEn try (P<: Punches  4  P.Raddr  ■  Raddr  4 
U(E"P:PunchEntry  (P<: Punches  4 
P.Raddr  -  Raddr 
4 

P. State  NotSpooling 
4 

P. Cyc I ePosi t i on  ■  AttachedToSpool ingProcese 
4 

P.AttachedProcess  ■  Process 
4 

E"DR: Ou  tpu  tDev i ceReques t (DR<: PunchSpoo I  Requests  4 
DR. Process  -  P.AttachedProcess 
4 

DR. State  -  Processing 
4 

DR. AttachedDevice  ■  P.Raddr))) 

->  Error  <> 

N"Punches  ■  Punches  ~~  S" (P)  I  I 
S" ((P.Raddr, 

P. State, 

/•ittttt'U/  Secur  i  tyTrai  ler, 

/*//#*/  URProcess, 

P.CIassesServedCurrent ly, 

P.C I assesServedNextCycle. 

P.Rel inqui shOeviceRequestState, 

P.ChannelStatusUord) ) 

4 

E''DR :  Ou  tpu  tOev  i  ceReques  t  (DR< :  PunchSpoo  I  Reques  t  s  4 
DR. Process  -  P.AttachedProcess 
4 

OR. State  -  Processing 
4 

OR. AttachedDevice  -  P.Raddr 
4 

N"PunchSpooiReque3ts  • 

PunchSpoo [Requests  ~~S"(0R)) 

4 

KernelCal led(RequestIO(P. Raddr) ) ) ) 
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21  Hut|  19/8  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Ttl-6062/1 01/00 


PU5a:  Interrupt  indicating  successful  completion  of 

tra  i I cr 


transform  PU5a(Raddr:  OeviceAddress) 

refcond  E"PiPunchEntry (P<j Punches  6 
P.Raddr  »  Raddr 
& 

P.  State  ■«-  NotSpooling 
& 

P.CyclePosi t ion  •  Secur i tyTrai ler 
<5 

P.ChannelStatusUord.Uni tChecK  -  false) 

effect  E"P:PunchEntry(P<s Punches  4  P.Raddr  •  Raddr  & 
N"Punches  ■  Punches  ^  S'*  (P)  1 1 
S" ((P.Raddr. 

/ftUtta/  (P. State  •  Oraining  ■> 

□rained 
<:■  P.  State) , 

A.v  W4\v/  Available, 

P. A  t  tachedProcess, 

/xtttt-!'/  P .  C I  assesSer vedNextCyc  I  e. 

P.  C I  assesS'ervedNextCyc  I  e, 

/*//#*/  NoNeed, 

P.ChannelStatusUord) ) ) 


secur i ty 


21  day  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/1 81/80 


PU5b?  Interrupt,  10  error  on  security  trai ler  output 


transform  PU5b(Raddr:  DevicsAddress) 

refcond  E"P:PunchEntry  (P<»Punches  4 

P.Raddr  ■  Raddr 
4 

P. State  NotSpooling 
4 

P.CyclePosi tion<iSH (Securi tyTrai ler, 

Secur i ty Tr a i I erUa i tForReady) 
4 

P.ChannalStatusUord.Uni tCheck  •  true) 

effect  E'TjPunchEntry  (PcPunches  4  P.Raddr  ■  Raddr  4 
ISTPunches  *  Punches  S"  (P)  1 1 
S"(  (P.Raddr, 

P. State, 

Securi  tyTrai  lerUai  tForReady, 

P. A  t  tachedProcess, 

P. C I asseaServedCurren 1 1 y , 

P. C I assesServedNextCyc I  a, 

P.Rel inqui shOeviceRequestState, 

P.ChannelStatusMord) ) 

4 

Kerne  I Cal lsd(SendMesaage (OpProcess) ) ) 


•-r-"'-—  s— r  m  r:v-’ 


21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TH-S08Z/181/00 


PU5c.*  Interrupt,  OK  to  retry  security  trailer  output 


transform  PUSe(Raddrt  OeviceAddress) 

refcond  E"PtPunchEntry  (PcPunches  & 

P.Raddr  -  Raddr 
8 

P. State  NotSpooling 
8 

P.CyclePosi tion  ■  Secur i tyTrai lerUai tForReady 
& 

P.ChannelStatusUord.Uni tCheck  ■  false) 

effect  E"PjPunchEntry (PcPunches  4  P.Raddr  •  Raddr  4 
N"Punches  ■  Punches  S"  (P)  1 1 
SM  (P.Raddr, 

P. State, 

/*##*/  Secur i ty Tra i I er , 

P. A  t  tachedProcaas, 

P.C I assesServedCurrent ly, 

P.  C I  assesServedNex  tCyc  I'e, 

P.Rel inquiahOeviceRequestState, 
P.ChannelStatuaUord)) 

4 

Kerne  I Cal  led (Request  10 (P.Raddr) ) ) 
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21  May  1978 

3.2.2  Unit  Record  Process  (Formal) 


System  Development  Corporation 
TM-B0S2/101/00 


OPIAbt  Drain  (Printer) 


transform  OPIAb (Raddr t  DeviceAddress) 

rafcond  E"P:Pr InterEntry  (P<tPrlntsre  4 

P.Raddr  ■  Raddr) 

effect  E"PtPr InterEntry (P<t Printers  4  P.Raddr  •  Raddr  4 
(P. State  -  NotSpool ing 
->  Error  <> 

N"Pr inters  ■  Printers  — »  S" (P)  1 1 
S'*  ((P.Raddr. 

/*#&>/  (P.CyclePosi tion  ■  Available  •> 

□rained 
<>  draining) , 

P.CyclePosi tion, 

P.AttachedProcess, 

P. C I aesesServedCurrent I y, 

P. C I assesServedNex tCyc I e. 

Av/Mto/  (P.CyclePosi tion  -  AttachedToSpoollngProceee  -> 

Sent 

<>  (P.CyclePosi t ion  •  Available  ■> 

P.Rel inquishOeviceRequestState 
<>  Shou I dSenu) ) . 

P. Channe I S tatusWord) ) 

4 

(P.CyclePosi tion  -  Available  -> 

KernelCal led(SendMessage(OpProcee») ) ) 

& 

(P.CyclePosi tion  ■  AttachedTospool ingProcess 
4 

P.Rel InquishOeviceRequestState  «*■  Sant  -> 

Kerne iCa 1 1 sd (SendMesaage (P. A t  tachedProcess) ) ) ) ) 


(  .  -  i.  ,  -  • _ , —  .  v  ■■  ■  ■-  - »  •  ■■;  ;  ■■ -  "■  . :*?-■  -t  -  .. 


<*;^*raaiasHBi^ BHapiwwttiaiy  -  v.-. 


21  flay  1978  System  Development  Corporation 

3.2.2  Uni  t  Record  Process  (Formal)  TM-6062/1 01/80 


< 


0P14c:  Ora  in  (Punch) 


transform  0P14c (Raddr:  OeviceAddress) 

refcond  E"P:PunchEntry  (P<iPunches  4 

P.Raddr  ■  Raddr) 

effect  E"P:PunchEntry (P<iPunchea  &  P.Raddr  ■  Raddr  4 
(P. State  ■  NotSpoolIng 
->  Error  <> 

N"Punches  ■  Punches  S"  (P)  1 1 
S’*  ((P.Raddr, 

Av##*/  (P.CyclePosi t ion  -  Available  •> 

□rained 
<>  Oraining) , 

P.CyclePosi tion, 

P. A  t tachedProcess, 

P. C I assesServedCurren t I y, 

P. C I assesServedNextCyc I e, 

A •>&#*/  (P.CyclePosi  tion  •  AttachedToSpool  ingProcesa  ■> 

Sent 

<>  (P.CyclePosi tion  •  Available  ■>> 

P.Rel inaul shOeviceRequestState 
<>  ShouldSend)) . 

P.ChannelStatusUord) ) 

4 

(P.CyclePosi tion  -  Available  -> 

Kerne  I  Cal  led(Sendf1essage(0pProcess) ) ) 

4 

(P.CyclePosi tion  ■  AttachedToSpool I ngProcees 
4 

P.Rel inqui shOeviceRequestState  Sent  -> 

Kerne  I  Cal  I  ed(Sendf1essage(P.  At  tachedProcess) ) ) ) ) 
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21  flay  1378  System  Development  Corporetlon 

3.2.2  Unit  Record  Process  (Formal)  TM-60S2/101/00. 

OPISbj  Start  (Printer) 


transform  OP15b(Raddr»  OevicsAddress, 

NewClassest  sat  of  Clast) 

refcond  E"PiPr InterEntry  (P<tPr inters  4 

P.Raddr  ■  Raddr) 

effect  E"P:Pr interEntry (P<jPr inters  4  P.Raddr  ■  Raddr  4 
(P. State  ■  NotSpooling 
■>  Error  <> 

N"Pr inters  -  Printers  S" (P)  II 
SH( (P.Raddr, 

/*##»>/  (NeuClasses  Empty 
I 

P.CIassesServedCurrently  Empty  ■> 

Started 
<>  P. State), 

P.CyclePosi tion, 

P. A  t  tachedProcess, 

/*##*/  (P .  Cyc  I  ePo  a  1 1  i  on  •  Available 
4 

NeuClasses  *»■  Empty  •> 

NeuClasses 

<>  P.CIassesSarvedCurrently) , 

/*##*/  (NeuClasses  «*■  Empty  » 

NeuC I  asses 

<>  P.CIassesServedNextCycle) , 

/ ttUttn/  (NeuClasses  Empty  -> 

(P.CyclePosi tion  -  AttachedToSpool IngProcess  ■»> 
Sent 

<>  (P.CyclePosi tion  -  Available  ■> 

P.Rel  inqui shOevIceRequestState 
<>  ShouldSend)) 

<>  P.Rel inqui shOeviceRsquestState) , 
P.ChannelStatusUord) ) 

4 

Kerne  I  Cal  I  ed  (Sendflessage  (OpProcess) ) 

4 

(NeuClasses  Empty 
4 

P.CyclePosi tion  -  AttachedToSpool ingProcesa 
4 

P.Rel inqui shOeviceRequestState  Sent  -> 

Kerne  I  Cal  led  (Sendflessage  (P.  At  tachedProcess) ) ) ) ) 
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System  Development  Corporation 
3.2.2  Unit  Record  Process  (Formal)  TM-6062/1 01/00 


DPI 5c j  Start  (Punch) 


transform  QP15c(Raddrt  OeviceAddress, 

NeuClassesi  set  of  Clast) 

refcond  EMPjPunchEntry  (PcPunches  A 

P.Raddr  ■  Raddr) 

effect  E"P:PunchEntry  (PcPunches  A*P. Raddr  »  Raddr  A 
(P. State  -  NotSpool Ing 
•>  Error  <> 

N'Tunches  »  Punches  S"  (P)  1 1 
S" ((P.Raddr. 

/>»##>>/  (NeuClasses  «»■  Em-.,  tu 

I 

P. C I assesSarvedCurrent I y  ««  Empty  as > 

Started 
<>  P. State), 

P.CyclePosi tion, 

P • A t tachedProceaa , 

/*##*/  (P.CyclePosi tion  -  Available 

A 

NeuClaeses  «*•  Empty  •> 

NeuClasses 

<>  P. Cl assesSarvedCurrent I y) , 

/ (NeuClasses  <*»•  Empty  ■> 

NeuC I  asses 

<>  P.ClassesServedNextCycle) , 

/ I’t/ftift/  (NeuClasses  Empty  ■> 

(P .CyclePosi tion  ■  AttachsdToSpool IngProcess  »> 
Sent 

<>  (P.CyclePosi tion  -  Available  -> 

P.Rel inqui shDeviceRequestStata 
<>  Shou I dSend) ) 

<>  P.Rel inqui shDeviceRequestStata) , 
P.ChannaiStatusUord) ) 

A 

Kerne  I  Cal  led(Sendf1essage(0pProcest) ) 

A 

(NeuClaeses  «*■  Emptu 
A 

P.CyclePosi tion  •  AttachsdToSpool IngProcess 

P.Rel  inqui shUeviceRequestState  «*■  Sent  -> 

Kerne  I  Cal  led(Sendf1essage(P.AttachedProceee)) ) ) ) 


/*#**/ 
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21  Hay  137S  System  Development 

3.2.2  Unit  Record  Process  (Formal)  TM 


OPQ:  Mi  seel  I aneous  commands 

commands: 

QUERY-UR 

QUERY-ALL 

QUERY«-RAOQR 

QUERY^TAPES 


Corporation 

8062/101/00 


transform  OPS (Command:  CommandName) 
refeend  CommandcCatB 

e  f  fee  t  Kerne  I Ca I  led (SendMsseage (OpProcess) ) 


21  Mau  1373  e  .  _ 

3.2.2  Unit  R.eord  Proem  IFor..!)5"*'*’  ggj>°™<igj 


(. 


OPIj 


Single  message  sent 
No  maps 

Single  response  expected 

No  device  state  information  modifications 


wummdnasi 


query-reader-spooljd 

QUERY*PR  l  NTER«*SP00L  I 0 
QUERY*-PUNCH«-SPQQL  1 0 
CHANGERS  YSTEM«*SP00L  1 0 


transform  OPi (CommandJ  CommandName) 


refcond  CommandcCatl 


■"’c*  N"p,na^te^rd:  " 

OpRequest, 

Command, 

S" ( (Cast inat Ion (Command) , 
nil, 

5  NoRespo nee) ) ) ) 

Kerne  (Called  (Sendfleeeag*  10e»t  inat » on  (Command) ) ) 
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21  Hay  1978 

3.2.2  Unit  Record  Proceaa 


Sue ten  Development  Corporation 
(Formal)  Tn-6862/101/00 


0P2t  Mu  1 1 i p I  a  message*  sent 

No  maps 

Responses  expected 

No  device  state  information  modifications 

commands* 

QUERY^ILES«-ALL 
QUERY'-REAOERrALL 
QUER  Y«-PR  I  NTER«*ALL 
QUERY*PUNCH*ALL 
QUERY«-HQUD 

CHANGE  *-SYSTEf1«-CLASS«-ALL 
transform  0P2 (Command:  CommandNama) 
refcond  Command<:Cat2 

effect  N  •PefidingRequeata  -  PendingRequeets  II 
3"  ( (NewNsgld, 

OpRequast, 

Command, 

S"R: Responses  lot (E"N*  ProcassName 
(N<* Curran tNkcpa  & 

H  *  (N,ni I ,NoResponse) ) ) ) ) 

& 

A"NxProces8Name  (N<iCurrentNKcps  -> 

Kerne  I Ca 1 1 ed (SendHesaage (N) ) ) 
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21  flag  1978 

3.2.2  Unit  Record  Proceee 


(Formal) 


System  Development  Corporation 


0P3j  Single  message  sent 

flapping!  User  id  ->  Nkcp  id 

Single  response  expected 

No  device  state  information  modifications 


commands t 

QUER  Y*-F  I  LES«-USER  1 0 


QUERY«-REAOER*-USER  I D 
QUER  Y«-PR  I  NTERrUSER  I D 


QUER  Y**PUNCH«-USER  I D 


CHANGE  4JSER 10 


FREE 


H0L0 

0RDER*-USER!0 
PURGE  4JSER ID 


transform  0P3 (Command!  CommandName) 


refcond  Command<:Cat3 

effect  NTondingRequests  -  PendingRequrrts  II 
S" ((Newflsgld, 
ttapUserld, 

Command, 

S" ( (AuthProcess, 

nil, 

NoResponse) ) ) ) 

4 

ICerne  I Ca  1 1  ed  (Sendflessage  (AuthProcess) ) 


21  May  1978 

3.2.2  Unit  Record  Process  (Formal) 


System  Development  Corporation 
Ttl-6062/101/00 


0P4a:  commands: 

0ACKSPAC 

FLUSH 

REPEAT 

transform  OPAa (Command:  CommandName, 

Raddr:  DeviceAddrass) 

refcond  Command<:Cat4 
8 

E"P:  Printer  Entry  (PcPr  inters  & 

P. Raddr  -  Raddr) 

effect  EHP: Pr i nterEntry (PcPr inters  8  P. Raddr  •  Raddr  8 
(~(P. State  NotSpooling 
8 

P.CyclePoei tion  -  AttachedToSpool ingProcees) 
■>  Error  <> 

N"PendingRequests  ■  PendingRequeets  II 
S"  ( (Neuflsgld, 

OpRequest, 

Command, 

S" ( (P.AttachedProcese, 
nil, 

NoReeponse) ) ) ) 

8 

Kerne  I Ca  1 1  ed  (SencWeaoage  (P.AttachedProcese) ) ) ) 
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21  flay  1378  System  Osvslopmsnt  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/101/B8 


OP4br  commands! 

BACKSPAC 

FLUSH 

REPEAT 

transform  0P4b (Command!  CommandName, 

Raddr:  OeviceAddress) 

refcond  Command<!Cat4 
8 

ETiPunchEntry  (P<i Punches  & 

P. Raddr  -  Raddr) 

:  fleet  EHPiPunchEntry (P<!Punches  8  P. Raddr  ■  Raddr  8 
(**(P. State  —  NotSpooiing 

8 

P.CyclePosI  t ion  ■  AttachadToSpooMngProcees) 
■>  Error  <> 

N"PendingRequests  -  PendingRequests  II 
S" ( (NewMsgld, 

OpRequest. 

Command, 

S" ( (P. AttachedProcess, 
nil, 

NoResponse) ) ) ) 

8 

Kerne  I Ca  I  I  ed  (Sendflessage  (P .  A 1 1 achedProcese) ) ) ) 
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21  day  1978  Syatom  Development  Corporation 

3.2.2  Unit  Racord  Procaaa  (Formal)  TM-6862/1B1/88 


0P5*  command i 

SPACE 

tranaform  0P5 (Command*  CommandNama, 

Raddr*  OavicaAddraaa) 

refcond  Command  -  SPACE 
8 

EHP:Pr intarEntry  (P<iPrlntara  8 
P. Raddr  ■  Raddr) 

effect  E"PtPr intarEntry (P<*Pr intar*  8  P. Raddr  ■  Raddr  8' 

(— (P. State  NotSpooling 
8 

P.CyclaPoai tion  -  AttachadToSpool IngPrccasa) 
»>  Error  <> 

NTendingRequeate  ■  PandingRaquaata  1 1 
S"  ( (Newdsgld, 

OpRaqueat, 

Command, 

S" ( (P.AttachedProcnaa, 
nil, 

NoReaponaa) ) ) ) 

8 

Kerne (Cal  I edfSendfleaaagefP. AttachadProcasa) ) ) ) 
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21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM~€062/101/88 


0P6t  commands! 

ORDER*-SYSTEN 
PURGE «-SYS  TEH 

transform  OPS (Command!  CommandName, 

Nkcpst  sat  of  ProceesName) 

rafcond  Commando CommandName 
& 

A"NjProceasName(NoNkcps  -> 
E"CNiNkcp£ntry 

(CNoCuri ‘^ntNkcps 

CN. Process  ■  N)) 

affect  N"PendingRequasts  ■  PendlngRequests  II 
S"  ( (Newflsgld, 

OpRequest. 

Command, 

S"Ri Responses  lot (ENNtProcessName 
(NoNkcps 

8 

R  «  (N.ni I .NoResponse) ) ) ) ) 

AMN:ProcessName  (NoNkcps  -> 

Kerne  I  Ca  1 1  ed  (Sendflassage  (N) ) ) 
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wi 


msw. 


21  Hay  1978 

3.2.2  Unit  Record  Process 


System  Development  Corporation 
(Formal)  TM-6062/101/00 


0P7ai  LOCATE  of  Reader 

transform  0P7a (Commandi  CommandName, 

Raddr:  OeviceAddress) 

refcond  Command  -  LQCATE*-RAOOR 
8 

E"RiReaderEntry  (R<: Readers  4 
R.Raddr  -  Raddr) 

affect  E"R:ReaderEntry(R<:Readars  8  R.Raddr  •  Raddr  8 

(R.CyclePoel tion  »<:S" (AttachedToSpool IngProceas, 

AttachedToUser) 

■>  Error  <> 

N"PendingRaquests  «  PendlngRequests  II 
S" ( (Newftsgld, 

OpRequest, 

Command, 

S"  ( (R. At tachedProcees, 
ni  I , 

NoResponse) ) ) ) 

Kerne  I  Cal  led  (Sandflessage  (0.  At  tachedProcees) ) ) ) 


136 
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21  Hay  1378  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/1 81/80 


GP7b:  LOCATE  of  Printer 

transform  0P7b  (Comandt  CommandName, 

Raddr i  CeviceAddresa) 

refcond  Command  ■  L0CATE*-RAD0R 
ft 

E"PiPr interEntry  (PoPrinters  ft 
P.Raddr  «  Raddr) 

effect  E"P:Pr interEntry (P<tPr inters  ft  P.Raddr  ■  Raddr  ft 

(P.CyciePosi tion  ~<i S”  (AttachsdToSpool IngProcass, 

AttachedToUser) 

•>  Error  <> 

NMPendingRequeats  -  PendlngRequests  II 
S" ( (NewHsgld, 

OpRequsst, 

Command* 

S" ( (P.AttachsdProcass* 
ni  I , 

NoResponss) ))) 
ft 

Kerne'Cal led(Sendf1eesage(P.AttachedProcesa) ) ) ) 


21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  1TI-S082/1B1/88 


OP7ci  LOCATE  of  Punch 

transform  0P7c (Command!  CcmmandNama, 

Raddr:  OavIcaAddrats) 

ra  fcond  Command  ■  L0CATE«-RA00R 
8 

E"P:PunchEntry  (P<» Punches  8 
P. Raddr  -  Raddr) 

affect  E"PiPunchEntry (P<iPunchaa  8  P. Raddr  •  Raddr  8 

(P;CyclaPoai tion  «<:S" (AttaehadToSpool IngProceae, 

AttachadToUaar) 

»>  Error  <> 

N"PendingRequeate  -  PandlngRaqueata  II 
S" ( (Neudsgld, 

OpRequast, 

Command. 

SH ( (P.AtteehedProcesa, 
nil, 

NoRaaponaa) ) ) ) 

8 

Kerne  I Cal lad(SandHassaga(P.AttachadProcasa) ) ) ) 


) 
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21  Mag  1978  System  Development  Corporation 

3.2.2  Unit  Racord  Procaaa  (Formal)  TH-6062/1 01/00 


0P7d:  LOCATE  of  Tapa  Oriva 

transform  0P7d(Commandi  CommandName, 

Raddrt  DaviceAddraaa) 

rsfcond  Command  «  LOCATE<*RADOR 
& 

LHT:TapeOriveErtry  (T<»TapeOr Ives  ft 
T.Raddr  -  Raddr) 

affect  E"T« TapaOr iveEntry(T<iTapaOrlvac  ft  T.Raddr  »  Raddr  ft 
(T. State  AttachadToUaar 
«>  Error  <>  * 

N"PendingRequeats  »  PandlngRequasts  II 
S" ( (Neuttagld, 

OpRaqjaat, 

Command, 

S"  ( (T.At*achedProceas, 
nil, 

NoRsaponaa) ) ) ) 
ft 

KarnelCal led(Sandf1asaage(T.AttachedProcB8s) ) ) ) 
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Suatam  Oavalopmant  Corporation 
TH-60G2/101/08 


OPS  i 


command: 

SHUTDOUN 


transform  0P8 (Command:  CommandNama) 
ra  fcond  Command  ■  SHUTDOUN 


affact  N"ShuttlngOoun  ■  trua 
& 

N"Pr i ntarSpoo IRaquasts  •  PrintarSpoolRaquests  -- 

S " DR i Qu tpu tDav I csEn tr y ( 

DR.Stata  -  Ual tlngForOavIca) 

& 

NHPunchSpoo IRaquasts  ■  PunchSpoo IRaquasts  — 

S " DR i Ou t pu tOav I esEn t r y ( 

DR. Stats  ■  UaltlngForDavIca) 


W,  Record  Proe...  '  "P^^Por  .  <  I  on 

0P3a«  Vary  off)  in*  (Reader-) 


tranaform  OPSa (Commands  CommandNama, 

Paddrt  OavicaAddraea) 

rafeond  Command  *  VARYtQFFUNE 

E”R)Re*dar€ntru  (RoRaadara  A 
n.Raddf  ■  Raddr) 


affect  E T s Raadar£n try (Ro flaadar  a  S  R.Raddr  -  Raddr  « 

u>* JJ »tion  ^*SW (Aval !•:.>*, Of fUna) 

N"c???2r2  "  R«*dara  3"  (R)  1 1 
j  —  s  <(R* Raddr, 

AvAw#/  NotSpooMng, 

Of  tLlna, 

R. At  tachedPraceea, 

R. Cl eaaaaSarvadCurrant lu, 

R.CI aaaaaSarvadNaxtCuc I  a, 

R. Channa iStatuaWord, 

R.UnaBuffarU 

O 

KernmlC*!  /ad(S*ndf1***age(0pProcaaa) ) ) ) 


21  flau  1978  Syatam  Oavalopmant  Corporation 

3.2.2  Unit  Racord  Proctaa  (Formal)  TH-S06Z/ 181/80 


0P9b«  Vary  offllna  (Pr In tar) 


tr  ana  form  0P9b  (Command!  CommandNarna, 

Raddrt  Oav I aaAddruaa) 

ra  fcond  Command  ■  VARY<-OFFLINE 

8 

E"PiPr IntarEntru  (P<tPr Intara  8 
P.Raddr  ■  RaddrF 

af fact  EHP»PrlntarEntry(P<iPr intara  8  P.Raddr  •  Raddr  8 
(P.CyclaPoal tlon  ~<tS" (Aval  lab  I  a, Of fLina) 
»>  Error  <> 

N"Prlntera  ■  Pr  intara  *«*  S"  (PI  II 
SM  (P.Raddr, 

/*#&>/  No  tSpoo ling, 

/*#**/  Of  fLina, 

P. A t  tachedProcaaa, 
P.CIaaaaaSarvadCurrant ly, 

P. C I aaaaaSarvadNaxtCyc I  a, 

P.Ral Inqul ahOavicaRaquaatStata, 
P.ChannalStatuaUord) ) 

8 

Kama  I  Ca  II  ad  (Sandflaaaaga  (OpProcaaa) ) ) ) 
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21  flag  1978  Syatea  Development  Corporation 

3.2.2  Unit  Racord  Procaas  (Formal)  TM-6862/1 01/00 


0P9c«  Vary  off  I  In#  (Punch) 


traneform  0P9c  (Commandi  ComaandNaae, 

Raddr:  OevIcaAddreae) 

refcond  Coaaand  ■  VARY«-OFFLINE 

8 

E"P»PunchEntry  (PcPunchee  4 
P.Raddr  •  Raddr) 

•ffact  EMP:PunchEntry(P<:Punche#  8  P.Raddr  ■  Raddr  8 

(P.CyclaPoai tion  ~<i$ " (Aval  labia, Of fLln«) 
«>  Error  <> 

N"Punchea  ■  Punch##  S" (P)  II 
SH ( (P.Raddr, 

/*##*/  No  tSpoo  ling, 

/*##*/  Of  fl  I  na, 

P.AttachadProcaaa, 

P. C I aaaaaSarvadCurrant I g, 

P. C I aaaeaServedNextCyc I  a, 

P . R# 1 1 nqu I ahOav I ceRequea  tS  t a  t a , 
P.ChannelStatuaUord) ) 

8 

Kerne  (Called  (Sendflaaeage  (OpProcaaa) ) ) ) 
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21  Mag  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tfl-6082/181/00 


0P9di  Vary  offline  (Tape  Drive) 


transform  0P9d (Commanot  CommandName, 

Radon  OevIceAddress) 

refcond  Command  -  VARY*-OFFLINE 
8 

E"T!  TapeOr  IveEntry  (TcTapeOrivea  8 
T.Raddr  -  Raddr) 

effect  E"T:TapeOriveEntry(T<jTapeOrives  8  T.Raddr  ■  Raddr  8 
(T. State  «<:S”(Avai I  able, Of fLine) 

»>  Error  <> 

N"TapeOr Ives  •  TapeDrlves  S" (T)  II 
S"( (T.Raddr, 

/*##*/  Of fLine, 

T.AttaehedProcsss) ) 

8 

Kerne  I  Cal  led(Sendf1easage(0pPracess) ) ) ) 
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21  Hay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/1 81/80 


1 

OP10ai  Vary  online  (Reader) 


transform  OP10a (Command:  CommandNama, 

Raddrt  OeviceAddreas) 

refcond  Command  ■  VARY«-ONLINE 
8 

E"RsReaderEntru  (R<i Readers  & 

R.Raddr  «  Raddr) 

effect  E"R:ReaderEntry(R<sReadere  &  R.Raddr  •  Raddr  8 
(~(R. State  •  NotSpooiing 
8 

R.CyclePosi t ion  -  OffLine) 

->  Error  <> 

N" Readers  «  Readers  S" (R)  II 
S”( (R.Raddr, 

/*##*/  Drained, 

/*##*/  Available. 

/*##*/  URProcess, 

/•btttt-k/  R.  C I  aasesServedNextCyc  I  s, 

R. C I aasesServedNextCyc I e, 

R. Channe I S ta tusUord, 

R.UneSuffer) ) 

8 

KernelCal led(Send1essage(0pProc8ee))) ) 
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21  flay  1978  System  Development  Corporation 

3.2,2  Unit  Record  Process  {Forme I )  Tft-6062/1 01/00 


OP10bs 


) 

Vary  online  (Printer) 


transform  OP10b (Commands  CommandName, 

Raddr t  OevicaAddreas) 

refcond  Command  -  VARY«-ONLINE 
8 

E"HtPr InterEntry  (P<sPrlntere  & 

P.Raddr  -  Raddr) 

affect  E”PtPr inter£ntry(P<jPr inters  8  P.Raddr  ■  Raddr  4 
(~(P. State  -  NotSpooling 
8 

P.CyclePosI  tion  ■  QffUne) 

->  Error  <> 

N"Pr Inters  -  Printers  —  S"  (P)  II 
S"( (P.Raddr. 


A uttttu/ 

Drained, 

/*##*/ 

Aval  table. 

/*#**/ 

URProcese, 

P. C I asaeeServedNex  tCyc 1  a 
P. C 1 assesServedNextCyc 1  a, 

/*»»*/ 

NoNesd, 

& 

P.ChamelStatusUord) ) 

Kerne  I Ca  1 1  ed  (Sandflessaga  (OpPr ocasa) ) ) ) 
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21  flaw  1978  System  Uavalopmant  Corporation 

3.2.2  Unit  Record  Proceea  (Formal)  Tfl-6062/1 81/00 


OP10cj  Vary  online  (Punch) 


transform  0P1 0c (Command!  CommanefNama, 

Raddr :  Dev i caAddrese ) 

refcona  Command  ■  VARY«-ON(_INE 
8 

E"PiPunchEntry  (P<«Punches  4 
P. Raddr  ■  Raddr) 

e'ffect  EMP:PunchEntry (P<tPunehee  4  P. Raddr  ■  Raddr  4 
(«*(P. State  -  NotSpooHng 
& 

P.CyolePoel  Won  ■  OffLine) 

■>  Error  <> 

N"Punchas  -  Punches  S"  (P)  1 1 
S" ( (P. Raddr, 

/>•<##*/  Drained, 

/*##*/  Available, 

/*##*/  URProcesa, 

/*##»/  P . C I aase*ServedNextCyc I e, 

P. C I assesServedNextCyc Is, 

/>•«##*/  NoNeed, 

P.GhannelS*atusUord) ) 

4 

Kerns  I Cal led(SendHes88ge(0pProcaes) ) ) ) 


21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Procese  (Formal)  Tfl-6862/101/08 


OPIBdt  Vary  online  (Tape  Drive) 


transform  OP10d (Command*  CommandNaaa, 

Raddri  OeviceAddreee) 

re'cond  Command  -  VARYrONLINE 
ft 

EMT:TapeDr i veEn try (T<»TapeOr ivee  ft 
T.Raddr  -  Raddr) 

effect  E"T:TapeOr IveEntrydcTapeQr Ivea  ft  T.Raddr  »  Raddr  ft 
(<*(T. State  -  OffLIne) 

■>  Error  <> 

N"TapeOr Ivee  -  TcpeCrivee  SMT)  II 
S"( (T.Raddr, 

/  itUttit/  Available, 

/*##*/  U.IProcaee) ) 

ft 

Kerne  I C*  1 1  «d  (Sendfleseage  (OpProceae) ) ) ) 


D 


ii 
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21  Mag  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  (TI-S862/1 01/30 


AUTH3at  Attach  device  to  process  (request  from  AuthProceas' 
(Reader) 


transform  AUTH3a (Raddr:  OeviceAddress, 

Process:  ProcessName) 

refcond  E"R:ReaderEntry  (RoReadars  A 

R.Raddr  -  Raddr) 

effect  E"R:ReaderEntry(n<:Rsoders  A  R.Raddr  •  Raddr  8 
(A"N:NkcpEntry  (NcCurrentNkepa  -> 

N. Process  *»•  Process) 

->  Error  <> 

N"Readere  -  Readers  ~  S" (R)  1 1 
S" ((R.Raddr, 

/*A/W  (R. State-Drained 

& 

R.CyclePosi t Inn-Aval labia 
8 

Gran ted A  cass-> 

NotSpool ing 
<>  R. State) , 

/*##*/  (R.State-Oralned 

8 

R.CyclePoei t ion-Avai (able 

GrantedAccess-> 

AttachedToUser 
<>  R.CyclePosi t ion) , 

(R.  State-Oral  ned 
8 

R. Cgc I ePos i t I on-Ava liable 
8 

GraritedAccess-> 

Process 

<>  R. AttachedProcess) , 

R. C I asaesServedCurrent I y , 

R. C I aaaeaServedNextCyc I e, 

R . Channe I S  t  a  tusUor  d , 

R.LineBuf for) ) 

8 

(R.State-Oralned 

8 

R. Cyc I ePos I t I on-Ava i I ab I e-> 

Kerne (Called (Gran  t Access (R.Raddr ) ) ) 

8 

Kerne  ICa  1 1  ad  (Sendflassaga  (Au  thProceas) ) ) ) 


|X  n»y  1978 

3.2*2  Unit  Record  Pr ocaae 


(Formal) 


System  Development  Corporation 
Tt1~8862/IB1/8B 


Attach  devlca 

(rr Inter) 


to  procaaa 


(raquaat  from  Authf-Vcseee) 


tr  ana  form  AUTH3b  (Raddr  j  Dev i ceAddreea, 
Pr ocaaai  ProcesaName) 

rafcond  E"P:Pr InterEntry  (PcPr  Inters  6 

P. Raddr  ■  Raddr) 


effect 


AWHIfe/ 


/*#**/ 


P,Prln(A"NrWkr^iPr,?^7  4  P*fladdr  *  *•<**•  « 
(A  Nmkcpfntry  (NcCurrentNkcps  -> 

N. Process  <—  Procaaa) 

•>  Error  <> 

r<<p*^lnt*r,~s",w  " 

(P. State-Drained 
ft 

P . Cyc I aPoa 1 1 1 on-Ava I  labia 
ft 

Gran  tedAcceas-> 

NotSpool Ino 
<>  P. State), 

(P.  S  ta  t e-Dr a  I  nad 
& 

P.CyelePoai t Ion-Aval labia 
ft 

Gran  tedAccase-* 

A  t  tachedTollaer 
..  P.Cuc/ePoaitlon), 

(P .State-Drained 
ft 

P. Cyc I aPoa It  Ion-Aval  labia 
ft 

GrantadAccaaa-> 

Pr ocaae 

P« AttachedProcasa) , 
r . C  aaaaaSarvadCurrant I y, 
a  O  ?M««5ervedNaxtCyc la, 

P. Ra 1 1 nqui shOav i ceRaquea  tS  ta  ta, 

P. Channe I S  tatusMord) ) 

(R. State-Drained 
ft 

P. Cyc I aPoa 1 1 1 on-Ava 1 1 ab I a-> 

Kama  I  Cal  lad  (GrantAccaaa  (P.Rsddr ) ) ) 

Kama  I  Ca  1 1  ad  (Sendtleawaga  (AuthPr ocaaa) ) ) ) 


AwMto/ 
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21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tfl-6062/181/08 


AUTH3ct  Attach  device  to  process  (request  from  AuthFrocess) 
(Punch) 


transform  AUTH3c (Raddr:  OeviceAddresa, 

Process:  ProceasNsme) 

refcond  E"P:PunchEntry  (Pc Punches  4 

P.Raddr  -  Raddr) 

effect  E"P:PunchEntry  (PcPunches  4  P.Raddr  ■  Raddr  4 
(AHN:NkcpEntry  (NcCurrentNkcps  -> 

N. Process  —  Process) 

»>  Error  <> 

N"Pu'iches  ■  Puncl  as  ««*  S*  (P)  1 1 
S"( (P.Raddr, 


(P.State-Orained 

* 

a 

P. Cyc 1 ePoa i t 1 on»Ava i labia 

p 

GrantadAccess-> 

Not Spool Ing 
<>  P. State) , 

(P.State-Orained 

P 

P.CyclaPoei tion-Avei table 

P 

/>>##*/ 

<* 

GrantedAccase» 

AttachedToUser 
<>  P.CuclaPosi tion) , 

(P.State-Orained 

P 

5 

P.CyciePosi tion-Avai table 

P 

• 

5 

GrantedAccess-> 

Process 

<>  P.AttachedProcess) , 
P.CIassesServedCurrent ly, 

P. C 1 aseesServedNextCyc 1 e, 

P.Rel inqui shOeviceRsquestState, 
P.ChannelStatusUord)) 

<a 

(R. State-Drained 

0 

m 

Ot 

P , Cyc 1 ePos i t i on-Ava i 1 ab 1 e-> 

Kerne (Called (Gr an tAccess (P.Raddr) ) ) 

Qi 

Kerne  1  Ca  1 1  ed  (Sendtlesssge  (Au  thProcsss) ) ) ) 

21  flay  1978  System  Development  Corporation 

3«2.2  Unit  Record  f3roc9ss  (Formal)  Tfl-6862/i 81/38 


AUTH3d»  Attach  taps  drive  (request  from  AuthProcess) 


transform  AUTH3d (Raddr:  OeviceAddreea, 

Process:  ProceseName, 

ReqAccsss:  Accessflodes) 

refcond  EMT: TapeOr I veEn try  (T<: TapeOr Ives  8 

T.Raddr  ■  Raddr) 

effect  EHT:TapeOriveEntry(T<:TapeDrlves  8  T.Raddr  -  Raddr  8 
(A'NiNkcpEntry  (N<: Curran tNkcps  -> 

N. Process  ««•  Process) 

->  Error  <> 

NHTapeOrivss  •  TapeOr ives  ««  S"  (T)  II 
SM  (T.Raddr, 

/*##*/  (T.State«Aval table 

8 

GrantedAeceas»> 

AttaehedToUsar 
<>  T. State). 

/*##>>/  (T.  S  ta  te-Ava  liable 

8 

GrantsdAccess"> 

Process 

<>  T.AttachedProcess) ) ) 

8 

KernelCal  led (Sendflessege (AuthProcess))) ) 
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21  flay  1978  Syatem  Development  Corporation 

3.2.2  Unit  Record  Procaaa  (Formal)  TH-6062/1 01/00 


OPllai  Attach  davica  to  procaaa  (requeat  from  operator)  (Raadar) 


tranaform  OPUa(Raddrt  OavIcaAddraaa, 

Proceast  ProcaaaName) 

rafcond  E"R»ReaderEntru  (R<iRead«ra  8 

R.Raddr  ■  Raddr) 

affact  EMR»ReedarEntry(R<»Readere  8  R.Raddr  ■  Raddr  8 
(A"N»NkcpEntry  (NcCurrantNkcpa  -> 

N.  Procaaa  «•>  Procaaa) 

->  Error  <> 

N"Raaders  •  Raadari  •—>  S" (R)  1 1 
SM  (R.Raddr, 

/*##«>/  (R .  S  t  a  t  a-Or  a  I  nad 

8 

R  Cgc  I  ttPoa  1 1 1  on«Av*  liable 
4 

GrantedAcceaa»> 

NotSpool ing 
<>  R.Statt), 

/>>##*/  (R.Sta*a«Orainad 

8 

R . Cyc I ePoa I t I un»Ava liable 
4 

GrantedAcceae»> 

AttachadToUaar 
<>  R.CyclePoal tlon) , 

/itttfU,/  (R.Sta.  ."•Ora  I  nad 

8 

R.DjclaPoji t ion-Aval labia 
8 

GrsntadAccoaa»> 

Process 

<>  R. AttachadProcaaa) , 

R.  C  i  assasSer  vedCu’-rant  I  y, 

R. C I aaaeaServadNaxtCyr I «T 
R.ChannelStatusUor-*, 

R.uireBuf  ler)) 

8 

Kama  I  Cal  ii\i(Sendhestage(OpProcess) ) 

8 

(R.Stata*Orained 

8 

R. Cyc I ePoa 1 1 1 on-Ava 1 1 ab I a-> 

(KarnalCal lad (GrantAccaaa (R.Raddr) ) 

8 

(GrantriAceesa  -> 

<arne  I  Ca  1 1  ad  (Sendflessage  (Procaaa) )))))) 
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21  hau  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tt1-686</101/B8 

OPllbt  Attach  device  to  process  (request  from  operator)  (Printer) 


transform  OPllb(Raddrt  DevicsAddress, 

Processt  ProcessName) 

refcond  E"PtPr InterEntry  (P<«Prlnters  8 

P.Raddr  ■  Raddr) 

effect  E"PjPr lnterEntry(P<jPr Inters  4  P.Raddr  •  Raddr  4 
(AMN:NkcpEntry  (N<» Curran tNkcpe  -> 

N.Procese  Proceee) 

•>  Error  <> 

N"Pr inters  ■  Printers  <*•*  S"(P)  II 
S"( (P.Raddr, 

/< (P.  State-Drained 
4 

P. Cyc I ePos I t I on-Ave liable 
4 

GrantedAcces*-» 

NotSpool Ing 
<>  P. State). 

/*##*/  (P. State-Ora I ned 

4 

P.CyclePosi tlon-Avai lable 
4 

GrantedAccess-> 

AttecheclToUeer 
<>  P.CyclePosi t Ion) , 

/*##*/  (P.State-flralned 

4 

P.CyclePosi tion-Ave I lable 

GrantedAccsss-> 

Process 

<>  P. AttachedProcsss) , 

P. C I assesSsr vsdCurrsnt I y . 

P.C I assesServedNextCye I e. 

P.Rel InquishOeviceRequestState, 

P . Channe I S  t  a tusUord) ) 

4 

Kerne  I Ca 1 1  ad (Sendfleseage (OpProceee) ) 

4 

(P. State-Drained 
4 

P, Cyc I ePos 1 1 1 on-Ava 1 1 ab I s-> 

(Kerne I Ca 1 1 ed (Gran tAccess (P.Raddr ) ) 

4 

(GrantsdAccess  -> 

Kerne  I  Ca  1 1  ed  (Sendfleseage  (Process) )))))) 


n—  ao  ,  Sg»t«m  Development  Corporation 

3.Z.2  Unit  Record  Procaaa  (Formal)  TI1-6062/1 01/08 


OPllci  Attach  davica  to  procaaa  (raquaat  from  operator)  (Punch) 


tranafopm  OPllc(RaddPi  OavicaAddpaaa, 

Ppocaaai  ProceaaName) 

pafcond  EHPiPunch£ntry  (PoPunchaa  A 

P.RaddP  ■  Raddp) 

•ffact  E"PiPunchEntry(P<tPunchae  0  P.RaddP  •  Raddp  8 
(A"NiNkcpEntry  (N<i Curran tNktpa  -> 

N.  Procaaa  —  Procaaa) 

■>  Error  <> 

NTunchaa  ■  Punchaa  —  S"  (P)  1 1 
S" ( (P.Raddr, 

(P.  State-Ora  inad 
0 

P.CyclaPoai t ion-Avai labia 
8 

GrantadAcceaa-> 

No  tSpoo 1 1 ng 
<>  P.Stata), 

/*##*/  (P.Stata-Orainad 

8 

P.CyclaPoal t ion-Avai tab  I  a 
4 

GrantadAccasa-> 

AttachadToUear 

,  P.CyclaPoal t ion), 

/■uttUin/  (P.Stata-Orainad 

8 

P.Cyc I aPoa it ion-Avai labia 
4 

GrantadAccaaa-> 

Procaaa 

<>  P. AttachadProcaaa) , 

P. C I aaaaaSarvadCurrant I y , 

P. C I aaeaaServedNextCyc I  a, 

P.Rel i nqu i ahOav I ceRaquae tStata, 

P.ChannelStatuaUord) ) 

4 

Kerne  I Ca 1 1  ad (SandMeaaage (OpProcaaa) ) 

4 

(P.Stata-Orainad 

4 

P.CyclaPoal t Ion-Avai lable-> 

(Kama  I  Ca  1 1  ad  (Gran  tAccaaa  (P.  Raddr ) ) 

4 

(GrantadAccaaa  -> 

Kama  ICa  1 1  ad  (Sendfleaaaga  (Procaaa) )))))) 


/a/Mto/ 
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21  Dag  1978  „  fl? 

3.2.2  Unit  Record  Pr oceaa  (Formal) 


Sy.t..  0.v.lopMntJop|or.tJjn 


0P12ai  Detach  dadicatad  dev  I  cm  from  uaar  (raquaat  from  operator) 
(Reader) 


tranaform  0P12a(Raddri  DevIceAddreaa, 

Proceaat  ProceiaName) 

refcond  E"RjRmadarEntry  (R<iReadera  8 

R.Raddr  ■  Raddr) 

effect  EHR»ReaderEntry(R<jReadera  8  R.Raddr  •  Raddr  8 
(~(R. State  •  NotSpooling 
8 

R.CyclePoal t Ion  -  AttachadToUear 
8 

R.AttachadProcaee  »  Procaaa) 

->  Error  <> 

N"Readere  ■  Readers  S" (R)  1 1 
S* ( (R.Raddr, 

R. State, 

A*##*/  OatachPanding, 

R. A  t  tachedProcaas, 

R.C I aasaaServadCurrant I y, 

R.CI aeeesSarvedNex  tCyc I  a, 

R.Chanr.a  I S  t  a  tuaUord, 

R.LlnaBuf far) ) 

8 

N"Pand I ngRaquoa t a  *  PandlngRaquaata  II 
S* ( (NauMagld. 

Ral inqui ahOevIce, 

Undefined, 

S" ( (R.AttachadProceaa, 
nil, 

NoRaaponaa) ) ) ) ) ) 
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21  flay  1978  Sustain  Development  Corporation 

3.2.2  Uni t  Record  Procaaa  (Formal)  TM-6862/101/08 


0P12bt  Detach  dedicated  device  from  user  (requeet  from  operator) 
(Pr Inter) 


traneform  0P12b(Raddr:  Oe'" I ceAddreee. 

Proceeat  ProceeaNaee) 

refcond  E"P»Pr InterEntry  (P<iPrlntere  8 

P.Raddr  ■  Raddr) 

effect  E"PjPr I nterEntry(P<»Pr Inters  8  P.Raddr  -  Raddr  8 
MP. State  -  NotSpoolIng 

8 

P.CyclePoei tlon  ■  AttachedToUser 
8 

P. AttachedProceae  -  Proceas) 

->  Error  <> 

N"Pr inters  ■  Printers  —  S" CP)  I 
S" ((P.Raddr, 

P. State, 

/*##*/  Oe  t  achPand I ng , 

P. A  t  tachedPr ocees, 

P. C I aaaeaServadCurrent I y , 

P. C I aaaeaSarvadNextCyc t  e, 

P.Rel InquIehOeviceRaqueatState, 
P.ChannelStatueUord) ) 

8 

N"PendlngRaquests  -  PendingRequeata  II 
S" ( (NewMogld, 

Re  I InquiahOevIce, 

Ur  defined, 

S* ( (P. AttachedProceae, 
nil, 

NoReaponae) ) ) ) ) ) 
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21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TPI-S062/101/80 


0P12c:  Detach  dedicated  device  from  user  (request  from 
(Punch) 


transform  0P12c(Raddrt  DeviceAddress, 

Process:  ProcessName) 

refcond  EHF:PunchEntry  (P<: Punches  8 

P.Raddr  -  Raddr) 

effect  E"P:PunchEntru(P<:Punches  8  P.Raddr  -  Raddr  8 
(~(P. State  -  NotSpooling 

8 

P.CyclePosi tion  -  AttachedToUser 
8 

P. AttachedProcess  ■  Process) 

■>  Error  <> 

NMPunches  •  Punches  S" (P)  1 1 
SM( (P.Raddr, 

P. State, 

/*##!>/  DetachPending, 

P. A  t  tachedProcess, 

P. C I asseaServedCurr ent I y , 

P. C I asaesServedNextCyc I e, 

P.Rel inquishDeviceRequsstState, 
P.ChannelStatusUord) ) 

8 

N"PendingRequeata  •  PendingRequests  II 
SH ( (NeuMsgld, 

Re  I inquishOevice, 

Undefined, 

S" ( (P. AttachedProcess, 
nil, 

NoResponse) ) ) ) ) ) 


operator) 


21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TI1-S062/1 01/00 


NKCP2a«  Detach  dedicated  device  from  user  (request  from  attached 
process)  (Reader) 


transform  NKCP2a (Raddr:  Dev i csAddrses, 

Process:  ProcassName) 

refcond  E"R:ReaderEntry  (R<: Readers  4 

R.Raddr  -  Raddr) 

effect  E"R:ReaderEntry (R<: Readers  4  R.Raddr  »  Raddr  4 
(~(R. State  -  NotSpooling 
4 

R.CyclePosition  »  AttachedToUser 
4 

R.AttachedProcass  ■  Process) 

*>  Error  <> 

N"Readers  -  Readers  <***  S*(R)  II 
S"( (R.Raddr, 

/*##*/  (Dev  i  ceRe  I  eased-> 

Ora  I ned 
<>  R. State) , 

/*##»>/  (Dev  i  ceRe  I  eased«> 

Ava  ‘liable 

<>  R.CyclePosi tion) , 

/*##*/  (DeviceReleased-> 

URProcess 

<>  R.AttachedProceas) , 

R. C 1 aasesServedCurrent I y , 

R. C I assesServedNextCyc I e, 

R . Channe i S  ta  tusUor d, 

R.LineBuf for) ) 

4 

Kernel Cal  led (Re IsaseOev ice (R.Raddr) ) 

4 

Kerne  I  Ca  1 1  ed  (Sendtlessage  (R.  A  t  tachedProcess) ) 
4 

Kerne  I Ca 1 1 ed (SendHessage (OpPr ocess) ) ) ) 


.  ***».«•-.*•  j-  _ 


21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  TM-6062/18i/00 


NKCP2b»  Detach  dedicated  device  from  user  (request  from  attached 
process)  (Printer) 


transform  NKCP2b (Raddr:  DevIceAddress, 

Process:  ProcassName) 

refcond  E"P:Pr InterEntry  (PoPrlnters  4 

P.Raddr  ■  Raddr) 

effect  E"P:Pr  InterEntrytPcPr inters  ft  P.Raddr  *  Raddr  ft 
(~(P. State  -  NotSpooling 

ft 

P.CyclePosItion  »  AttachedToUeer 
ft 

P.AttachedProcesr  •  Process) 

■>  Error  <> 

N"Pr Inters  •  Printers  **«*  S"  (P)  II 
SH( (P.Raddr. 

/*##*/  (Dev  I  ceRe  I  eased-> 

Drained 
<>  P. State) , 

/■iitttt*/  (Dev  i  ceRe  I  eased-> 

Ava liable 

<>  P.CyclePosItion), 

/*##*/  (Dev i ceRe I eased-> 

URProcess 

<>  P.AttachedProcess), 

P. C I assesServedCurrent I y, 

P. C I assesServedNex iCyc I e, 

P.Rel InqulshOeviceRequeetState, 
P.ChannelStatusUord) ) 
ft 

Kerne  I Ca 1 1 ed (Ra I easeOev I ce (P . Raddr ) ) 
ft 

KernelCal led(SendMeesage(P.AttachedProcea») ) 
ft 

Kerne ICa 1 1 ed (SendMeseage (DpProcess) ) ) ) 


21  flay  1978  System  Development  Corporation 

3.2.2  Unit  Record  Procese  ('-‘ormal )  1TI-S0S2/1 81/00 


NKCP2cj  Detach  dedicated  device  from  user  (request  from  attached 
procese)  (Punch) 


transform  NKCP2n (Raddr »  OevicaAddreea, 

Process:  ProceasName) 

refcond  E"P:Punch£ntrq  (P<iPunches  A 

P.Raddr  -  Raddr) 

effect  E"P:PunchEntru(P<jPt.inches  8  P.Raddr  ■  Raddr  8 
(•.(P.State  •  Not  Spooling 
8 

P.CyclePoel tion  -  AttachedToUser 
8 

P. AttachedProcess  -  Process) 

->  Error  <> 

N"Punches  -  Punches  S"  (P)  1 1 
S"(  (P.Raddr, 

/itUUit/  (Dev  I  ceRe  I  eased» 

Dra i ned 
<>  P.State), 

/itttM-u/  (Dev  i  ceRe  I  ea«ed-> 

Aval  table 

<>  P.CyclePosI tion) , 

/<<##*/  (Dev  i  ceRe  I  eassd-> 

URProcess 

<>  P. AttachedProcess) , 

P. C I asseeServedCurrent I y, 

P . C I assesSer  vedNex tCyc I e , 

P.Rel Inqui shOeviceRequestState, 
P.ChannelStstusUortO ) 

8 

KernelCal I ed (Re ieaseOev ice (P.Raddr) ) 

8 

KernelCal  i ed(Sendf1essage(P. AttachedProcess) ) 

8 

KernelCal !ed(SandKessage(LpProcsss)) )) 
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21  Hay  197S  System  Development  Corporation 

3.2.2  Unit  Record  Proceae  (Formal)  Tlt-6862/101/80 


) 

OPI2d»  Detach  dedicated  device  from  user  (requeot  from  operator) 

(Tape  Drive) 


transform  0P12d(Raddri  OevlceAddrest, 

Process*  ProcsssNaee) 

refcond  E”)  *TapeDriveEntry(T<tTapeOr ivee  & 

T.Raddr -Raddr) 

effect  E"T:TapeOr iveErvtry(T<:TapeCrl  vse  &  T.Raddr  »  Raddr  & 
(~(T. State-Attached 
£ 

T. A  t tcchedFrocsss-Process) 

->  Error  <> 

I*  "TapeOr  i  ves  -  TapeDrives  ««*  S*(T)  II 
S"H  T.Raddr, 

/*##*/  DetachPending, 

T. A 1 1 achedPr ocess) ) 

.  •* 

fCPsndingRequests  -  Pendi ngRequssts  II 
S" ( (Newflogld, 

Re  I inquisnOevIce, 

Undefined, 

S” ( (T.AttachedProcesa, 

nil, 

NoRaeponee) ) ) ) ) 7 
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21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  (Formal)  Tt1-686z/lBl/08 


NKCP2d»  Oetach  dedicated  device  from  user  (request  from  attached 
process)  (Tape  Orive) 


transform  NKCP2d(Raddr:  DeviceAdrirnss, 

Process:  ProcessName) 

refcond  E"T:TapeOr IveEntry  (T<: TapeOr Ives  & 

T.Raddr  •  Raddr) 

effect  E"T:TapeQr i veEn try (T<: TapeOr Ives  8  T.Raddr  ■  Raddr  8 
(<v(T. State  •  Attached 
8 

T.AttachedProcess  •  Process) 

->  Error  <> 

N"  TapeOr  Ives  »  TapeOr  Ives  *•**  S*  (T)  II 
S"(  (T.Raddr, 

At##*/  (DevlceReleassd-> 

Aval  labia 
<>  T. State), 

/*##*/  (Dev  i  ceRe  1  eased-> 

URProcess 

<>  T. At tachedProceas) ) ) 

8 

Kerns  I Ca 1 1 ed (Re  I easeOev I ca ( T . Raddr ) ) 

8 

KernelCal  led(Sendf1essaye(T.AttachedProceas) ) 
8 

Kerne (Called (SendMessage (OpProceso) ) ) ) 
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il2?2W  'un?«  Wd  Proe.„  ,ForMl)a'*'“  °—op..n,_Cog|or.t;|g 
fflM&j  Pr'’C’”  '••Hnqulthlnj  d.vlc.  r.qu.Itad 


tran*  form  NKCPi a  (Raddr * Oev  i  ciAddr , 
Proceaai  ProceeaNaae) 

ratcond  E"RiP«*#derEntru  (R<iR«ad«ri  A 

R. Raddr  -  Raddr) 


effect 


fun«e(o«rqntrum<! 

1^-fB  Cl.i. 


AvAW*/ 

/*##*/ 


(-‘{R.Stata  ■  NotSpooHno 

4  * 

P.CycfaPoaitfon  .  OetachPendlng 
R.AttachedProceaa  •  Proceee) 

J>  Error  <> 

"  fl«ad*r*  —»  S“ (R)  I ) 

S“{(R. Raddr, 

(Oev i ceAe I eaaed*> 

Drained 
<>  R. State), 

(DevlceRelea»ed«*> 

Aval  labia 

<>  R.CyclePoaltlon), 

(Uev i ceRe I eaead»> 

URProceaa 

<>  R.AttachedProceaa), 

R. C  I  aeeaeServedCurrant I u, 

R. C I asseaSer vadNex tCyc I  a, 
R.ChannelStatusUord, 

R.LineBuf far)) 


Kerne  I Ca 11  ad (Re I aaaeOev i ce IR. Raddr) ) 

Kerne  ICa  Had  (SendfleaaagafR.  At  tachadProcaaa) ) 
Kerne  (Called  (Sendtteaaege  (OpPr  ocaee) ) ) ) 
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3.2.2  Uni  t  Record  Process  (Formal)  171-6962/181/88 


NKCPlb*  Process  message,  relinquishing  device  as  requested 
(Pr Inter) 


transform  NKCPlb (Raddr *0ev I ceAddress, 

Process* ProcessName) 

refcond  E"P*Pr InterEntry  (P<*Pr inters  4 

P.Raddr  ■  Raddr) 

effect  E"P*Pr interEntry(P<*Pr Inters  4  P.Raddr  »  Raddr  4 
(-(P. State  -  NotSpooling 

4 

P.CyclePosI tion  -  OetachPendlng 
4 

P.  AttachedProcese  -  Prociss) 

->  Error  <> 

NMPr Inters  -  Printers  —  S" CP)  II 
S"( (P.Raddr, 

/  itttUik/  (Dev  i  ceRe  I  eased-> 

Drained 
<>  P. State), 

/*##*/  (Dev  i  ceRe  I  eased-> 

Avai table 

<>  P.CyclePoel tlon) , 

/*##*/  (Dev i ceRe I eased-> 

URProcasa 

<>  P. AttachedProcess) , 

P. C I assesServedCurrent I y , 

P.  C I aseeeSarvedNextCyc I e, 

P.Rel Inqui ehDevicsRequestState, 
P.ChannelStatusUord) ) 

4 

KernelCal led (Re  I  ease, lev ice (P.Raddr) ) 

4 

KernelCal  led (SendMessage(P. AttachedProcess) ) 
4 

Kerne I Ca I i ed  (SendMessage  (OpPr ocese) ) ) ) 
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21  flau  1978  Sustain  Development  Corporation 

3.2.2  Unit  Racord  Procaaa  (Formal)  Tfl-6062/1 81/00 


NKCPlc:  Procaaa  meaaage,  ral Inqulahing  davlca  aa  raquaatad 

(Punch) 


tr anaf oris  NKCPlc  (Raddr > Oav I  caAddraaa. 

ProceastProcasaNa-ta) . 

rafcond  E"P«PunchEntry  (P<<Punchee  8 

P. Raddr  -  Raddr) 

offset  ETjPunchEntru  (P<tPunchea  8  P. Raddr  ■  Raddr  8 
(~(P. State  -  NotSpoolIng 

8 

P.CyclaPoal tlon  -  DatachPanding 
8 

P. AttachectfVoceaa  -  Procaaa) 

•>  Error  <> 

N"Punchea  -  Punches  **<■*  S"  (P)  1 1 
SM((P. Raddr, 

Av##*/  (Dev  I  ceRa  I  eaaod» 

Drained 
<>  P. State), 

Av##*/  (Oav I coRe I eaaed-> 

Ava liable 

<>  P.CyclaPoal tlon) , 

AvtfiW  (Oav  I  caRo  I  aasad» 

URProceaa 

<>  P.AttachodProceoa) , 

P. C I aaaosServedCurrent I y, 

P . C I aasasSer vedNex  tCyc I  a. 

P.Rel Inqui shOevicaRaquastState, 
P.ChannalStatusUord) ) 

8 

Kerne i Cal ied(ReleaaeOevice(P.Raddr) ) 

8 

Kerna I Ca 1 1  ad (SondMaaaaga (P. A  t  tachsdProcess) ) 
8 

Kama  I  Ca  1 1  ad  (Sendflssaaga  (OpProcasa) ) ) ) 


1H7?.  o  ^  c  System  Development  Corporation 

3.2.2  Ur.lt  Record  Proceae  (Formal)  Tfl-6062/1 01/08 


% 


0P13i  Loadbuf 


transform  0P13 (Raddr:  DavicaAddraas) 

rafcond  E"PtPr IntarEntry  (PoPr  intarift 
I  P.Raddr  -  Raddr) 

affact  EHP:Pr lnterEntry(P<i»rlntara  g  P.Raddr  «  Raddr  ft 
(~(P. State  ■  Orainad 
ft 

P.CyclaPoai tion  ■  Available) 

•>  Error  <> 
true) ) 

I 
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V'Jfei  1.^7®  _  .  _  Syate*  Development  Corporation 

3.2.2  Un I t  Record  Procaea  (Formal)  Tfl-6862/ 181/80 


NKCPldi  Proceaa  meaeage,  rallnqulahlng  davlca  aa  r aqua a tad  (Tan# 
Drlva) 


tranaform  NCKPld(Raddri  DavicaAddraaa, 

Proceaa:  Pr'oceaaName) 

refcond  E*TiTapeDrlveEntry  (T<* TapaOr I vaa  4 

T.Raddr  ■  Raddr) 

affect  E"Tj TapaOr I ve€ntry(T<i TapaOr I vaa  4  T.Raddr  •  Raddr  4 
(~(T. State  *  OatachPanding 
4 

T. AttaehedProcea a  ■  Procaaa) 

•>  Error  <> 

N"TapaOrlvaa  -  TapaOr Ivaa  S*(T)  II 
S"( (T.Raddr, 

/*##*/  (DaviceReleaaed«> 

Aval  labia 
<>  T.Stata) 

/ft##*/  (Oav I caRa I aaaad>> 

URProceea 

<>  T. AttachadProcaaa) ) ) 

4 

KernelCal lad(RalaasaOavlca(T.Raddr) ) 

4 

Kama  I  Ca  1 1  ad  (Sanddaaaaga  ( T .  A  t  tachadPr ocasa) ) 
4 

Kama  (Called  (Senddaaaage  (OpProcaaa) ) ) ) 


► 
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21  flag  1978  Syetem  Development  Corporation 

3.2,2  Unit  Racord  Proceee  (Formal)  Tft-S862/181/8B 


OFlldt  Attach  tape  drive  (requeat  from  operator) 


traneform  OPlld(Raddrt  OovIcaAddreaa, 

ReqAcceeet  Acceeeflodee, 

Tapr.Sad.eve  1 1  ProceeeNama, 

Proceeet  ProceeeNama) 

refcond  EMTjTapeOriveEntry  (ToTapeOr  IveeA 

T.Raddr  -  Raddr) 

affect  E"TiTapeOrlveEntru(T<iTapeDrlvee  8  T«Raddr  •  Raddr  8 
(A"N:NkepEntry  (NoCurrantNkcpe  -> 

N.Proceae  «*-  Proceee) 

->  Error  <> 

EHNtNkcp£ntry(N<jCurrantNkcpe  8 
N. Precaea-Pr oceee 

8 

N"TapeOrlvr*  -  TapeOrlvee  S" (T)  II 
SM ( (T.Raddr, 

/ft##*/  (T . Raddr < : N. Usab I eT apeOr I vee 

8 

T. State-Aval lable 
8 

CheckedSecLovei 

8 

GrantedAcceae«> 

Attached 
<>  T. State) , 

/*##ft/  (T. Raddr< j  N, Usab I eT apeOr I vee 

8 

T. State-Aval lable 
8 

CheckedSacLeve  f 
8 

GrantedAcceee-> 

N.Proceea 

<>  T.AttachedProceee))) 
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21  Hay  1378  Systam  Oavalopmant  Corporation 

3.2.2  Unit  Racord  Procats  (Formal)  TH-6062/1 81/00 


Kama I Ca t I sd (SendNaasaga (OpProctsa) ) 

(T. Raddr <i N. Uaab I aT  apaOr i vat 
8 

T.Stata  -  Availabla)-> 

(Kama  I  Ca  i  I  ad  (ChackSacLava  I ) 

8 

(ChackadSacLevs I -> 

(Kama  I  Ca  1 1  ad  (Gran  tAccaaa  (T.  Raddr ) ) 

8 

(GrantadAccaaa-> 

Kama  I  Ca  1 1  ad  (SandHeseaga  (N.  Procaaa) )))))))) 
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3.2.2  Unit  Record 


System  Development  Corporation 
Proceee  (Formal)  TM-6062/1 01/00 


AUTH1 t  Add  Nkcp 


transform  AUTH1 (Process*  ProcessNama 

Readerst  sat  of  DavicsAddreaa, 
Printers!  sat  of  Oav I ceAddrsss, 
Punches!  set  of  Devi ceAddrsss, 
TapeDr ivssi  set  of  Dev  I ceAddrsss) 


refcond  true 

affact  (E’,NiNkcpEntry  (N<i Curran tNkcps  8 

N. Process  ■  Process) 

■>  Error  «> 

NHCurrsn tNkcps  -  CurrentNkcpe  1 1 
S" ( (Process, 

Readers, 

Printers, 

Punches, 

TapeOrives))) 
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21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Procaaa  (Formal)  TH-B062/101/K? 


AUTH2t  Delate  Nkcp 


i 


/ 


transform  AUTH2(Procasst  ProcessName) 

affect  (ATiJiNkcpEntry  (N<!CurrentNkcpa  -> 

N. Process  ««■  Procaaa) 

I 

E"DRjQutputDeviceRaquest 

( (0R<iPr in terSpoo I Requests 
I 

OR  < : PunchSpoo I Requests) 

8 

CR. Process  ■  Process 
8 

OH. State  -  Processing) 

E"R»ReaderEntry(R<: Readers  8 
R.  AttachedProcess  »  Procesa 
8 

R.CyclePooi tion<»S"  (AttachedToSpcoi  ingProceae,  Attached! oUser)) 

EMP:Pr interEntry (P<iPr inters  8 
P. AttachedProcess  *  Process 
8 

P.  Cyc  I  ePoa  i  1 1  one  S"  (At  tachedToSpoo  I  i  ngProcese,  At  tachedToUaer ) ) 

E"P:PunchEntry (P<t Punches  8  ) 

P. AttachedProcess  -  Process 
8 

P.CyclePosi  tioneS"  (At  tachedToSpoo  I  IngProcesSf  At  tachedToUaer) ) 

E " T : T apeOr i veEn  t r y  (T < *  T apeOr i ves  8 
T. AttachedProcess  ■  Process 
8 

T. State  ■  At tachedToUaer) 

">  Error  <> 

EMNiNkcpEntry (N<»CurrentNkcps  8  W. Process  ■  Process  8 
N"CurrentNkcps  ■  CurrentNkcps  «*S" (N) 

8 

N"Pr InterSpooiRequests  -  Pr I nterSpoo (Requests  — 

S"0fl: OutputDev i csEnt^y 
(0R<»  Pr i nterSpoo I  Requests 
8 

OR. AttachedProcess  -  N. Process) 

8 

N"PunchSpoo I Requests  -  PunchSpoo I  Requests  — 

S"Dfl: Ou tputOev <  ceRequeat 
(DR -t  t  PunchSpoo  I  Reques  t  s 
8 

OR. AttachedProcess  -  N.Process))) 
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21  May  1978  System  Development  Corporation 

3.2.2  Unit  Record  Process  'Formal)  TM-S062/101/80 


KEHNlt  moorage  from  Kernel,  re  device  availability  (during  scan 

at  system  initialization) 

transform  KERN1 (Raddr:  Cev  icaAddrsss) 

effect  (E"R:ReaderEntry(R<:Readars  4  R.Raddr  »  Raddr)  ■> 

E"RsReaderEntry (R<s Readers  4  R.Raddr  -  Raddr  4 
(R. State  -  Drained  -> 

WReaders  -  Readers  »•*<  S"  (R)  II 
S”  ((R.Raddr, 

/*##*/  No  t Ava  1 1  ab  I  eForSpoo  I  i  ng 

/«**«/  OffLine, 

R.AttachedProcess, 

R. C I assesServedCurrent I y , 

R. C I aasesServedNex tCyc I e, 

R. Channe I S ta  tusWor d, 

R.LineBuf fer) ) 

<>  Error)) 

<>  ETsPr  intsrEntry(P<:Pr Inters  4  P. Raddr  •  Raddr)  -> 
E"P:Pr InterEntry (PcsPrinters  4  P. Raddr  -  Raddr  4 
(P. State  *  Drained  -> 

N"Pr Inters  •  Printers  «**  S"  CPI  II 
S"  UP. Raddr. 

/*##*/  No  tAva i I ab I eForSpoo ling, 

/**#*/  OffLine, 

P . A  t  tachedProcess , 

P.CIassesServedCurrently, 

P. C I aasesServedNex tCyc I e, 

P.  Re  I i nqu i shOev I csRequeetS tate, 

P. Channe IStatusUord)) 

<>  Error) ) 

<>  E"P:PunchEntry(P<:Punches  4  P. Raddr  »  Raddr)  •> 
E"P:PunchEntry(P<s Punches  4  P. Raddr  -  Raddr  4 
(P. State  ■  Drained  ■> 

N"Punches  -  Punches  S"  (P)  1 1 
S" ( (P. Raddr, 

,  /*##*/  NotAvai lab  I eForSpoo ling, 

/*##*/  OffLine, 

P. At tachedProcess, 

P.CIassesServedCurrent ly, 

P. C lassesServedNextCyc I e, 

P.Rel i nqu i shOev iceRequestState, 

P . Channe I S  t  a  t usUord) ) 

<>  Error) ) 

<>  E"T:TapeDriveEntry(T<:TapeQrives  4  T. Raddr  •  Raddr)  -> 
E"T:TapeOriveEntry(T<:TapeOrives  4  T. Raddr  -  Raddr  4 
(T. State  -  Available  ■> 

N"TapeDrives  -  TapeOrives  S"(T)  II 
S"((T. Raddr, 

/*#«'»/  OffLine, 

T. At tachedProcess) ) 

<>  Error))) 

end  URProcess 
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21  May  1978  System  Development  Corporation 

3.3.1  Authorization  Process  (informal)  TM-S862/191/80 


3. 3.1 i  Authorization  Process 
Informal  Description 

This  section  contains  the  Informal  description  of  the 
Authorization  Process  of  KVfl/378. 


Overview 

The  Authorization  Process  performs  several  functions  of  major 
Importance  to  the  systeip  security  of  KVH/370.  The  Authorization 
Process  acts  as  the  security  policeman  of  the  system  by 
controlling  accessibility  to  the  machine  via  the  logon/off 
protocols,  and  by  helping  the  Kernel  Keep  the  system  in  a  set  of 
security-preserving  states  by  controlling  non-unit  rwcord  device 
attachment  for  all  system  processes.  it  also  examinee  the 
security  conditions  surrounding  all  device  attachments  (for  both 
unit  record  and  non-unit  record  devices)  to  NKCPs. 

The  Authorization  Process  performs  the  following  major  functions* 

-  logon  sequence* 
logoff  sequence* 

-  links* 

-  non-unit  record  device  attachment  for  all  other 
system  processes* 

security  condition  assurance  for  all  device 
attachments)  <;nd 

-  NKCP  creation  and  deletion. 

The  Authorization  Process  monitors  the  statue  of  all  non-unit 
record  devices  In  i  ts  device  tables.  It  uses  a  data  structure 
cal  led  the  ’directory’  to  control  both  user  access  to  the  system 
and  the  processing  of  links. 

Figures  four  and  five  display  the  organization  of  the  transforms 
involved  in  the  logon  protocol.  Figure  six  displays  the  various 
states  in  which  a  particular  line  can  exist,  and  the  legal 
transitions  between  states. 
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3.3.1  Authorization  Process 


Svstem  Development  Corporation 
(Informal)  TM-6062/ 101/00 


ATT_AqHSS 


Figure  i 

THE  ATTACH  VALIDATION  SEGUSf.'CZ 
(PROCESS  STRUCTURE) 


1 
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21  May  1978  System  Development  Corporation 

3.3.1  Authorization  Process  (Informal)  TM-6062/ 101/00 


INITIAL  LOGON  RETRY 


Figure  5 

The  Attach  Validation  Sequ 
(State  Transitions) 
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21  flay  1978  System  Development  Corporation 

3.3.1  Authorization  Procaaa  (Informal)  Tt1-60S2/ 101/00 


The  Logon  Sequence 

When  -the  user  presses  the  'break'  key  after  dialing  into  the 
system,  the  resulting  interrupt  Is  rsflected  by  the  semi-trusted 
process  monitoring  all  input  lines  to  the  Authorization  Process, 
Mhich  then  requests  a  'read'  on  the  line.  The  uear  then  types  the 
logon  Information,  consistir  nf  at  least  a  header  string,  a  user 
id,  a  password,  and  a  security  level.  The  Authorization  Process 
uses  this  information  and  the  directory  Information  associated 
with  this  user  to  determine  whether  the  attempted  logon  will  be 
allowed.  The  factors  involved  in  this  decision  Includet 

-  the  user's  security  level  provided  in  the  logon 
1 1  nej 

-  the  communication  line's  security  level} 

-  the  security  levels  associated  with  the  user  in  the 
user's  directory  entry}  and 

-  whether  an  NKCP  controlling  the  requested  security 
level  currently  exists  in  the  system,  the  number  of 
NKCPs  currnnt I y  extant,  and  the  maximum  allowable 
number. 


The  Authorization  Process  must  perform  a  fair  amount  of  processing 
In  order  to  determine  whether  the  user  is  allowed  to  log  on  given 
the  current  state  of  the  system  and  the  requested  security  level. 

Assuming  the  foaon  decision  is  affirmative,  the  Authorization 
Process  uses  the  dedicated  devices’  section  of  the  directory 
entry  for  this  user  to  determine  those  devices  that  must  be 
attached  to  (the  controlling  NKCP  for)  the  new  VM  in  order  for  the 
VM  to  perform.  The  Authorization  Process  attaches  the  permissible 
devices  (pursuant  to  security  conditions  and  the  requested 
security  level),  the  communication  line  and  the  new  VM  to  the  NKCP 
controlling  this  security  level.  These  attachments  all  occur 
after  first  creating  the  NKCP  if  necessary  and  possible. 

It  then  notifies  the  controlling  NKCP  of  the  existence  of  the  new 
VM.  Part  of  the  message  sent  to  the  NKCP  contains  non-secur  1  ty¬ 
re  levant  directory  information  about  the  VM,  in  particular 
Information  about  the  Vfl’s  attached  devices. 
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The  Logoff  Sequence 

Uhen  a  VM  is  to  be  purged  from  the  system,  the  NKCP  releasee  all 
the  devices  dedicated  to  the  Vtl,  performs  accounting,  and  then 
informs  the  Authorization  Process.  It  also  provides  the  reason 
for  the  purge,  which  could  be  because  the  user  logged  off,  or 
because  the  NKCP  forced  the  user  off  (due  to  operator  requests 
FORCE  or  SHUTOOUN) ,  or  because  the  user  use  disconnected  and  at 
least  fifteen  minutes  have  elapsed,  etc. 

The  Authorization  Process  proceeds  to  destroy  the  Vtl  and,  if 
neceasary,  causes  the  communication  line  to  be  re-enabied  for  a 
new  user  connection. 

If  the  Kernel  does  not  allow  the  Vtl  to  he  c^etroyed,  the 
Authorization  Process  informs  the  NKCP  of  this  ?a;t. 


21  flay  1978  System  Development  Corporation 

3.3.1  Author  I zat ion  Process  (Informal)  TM-6062/101/00 


NKCP  Creation  and  Deletion 

An  NKCP  is  added  to  the  system  when  an  attempt  Is  made  to  perform 
processing  at  a  security  level  not  currently  being  provided  by  the 
system.  This  request  for  support  of  a  new  security  level  may  be 
caused  by  a  user  logging  on  or  by  an  Input  spooling  operation. 

The  Authorization  Process  attempts  to  create  the  NKCP  to  service 
the  naw  security  level.  If  it  succeeds,  the  new  user  Is  attached 
in  the  normal  manner  or,  In  ths  case  of  an  Input  spooling 
operation,  the  Unit  Record  Process  is  informed  of  the  availability 
of  the  new  NKCP  so  that  it  may  attach  ths  input  device  to  ths 
NKCP. 

0u<  to  limitations  of  Kernel  table  space  or  system  performance 
requirements,  creation  of  the  new  NKCP  may  not  be  possible*  In 
this  case  the  user's  logon  attempt  Is  rejected  or  the  input 
spooling  operation  Is  aborted. 

It  may  also  be  the  case  that  an  NKCP  has  been  created  and  the 
reason  for  ita  existence  has  disappeared.  This  will  occur  if  the 
user  does  not  complete  the  logon,  the  attempt  to  create  a  VH  fails 
dur  to  lack  of  table  space,  ths  input  device  becomes  disabled  or, 
in  the  case  of  an  Input  spooling  operation,  the  NKCP  may  not  use 
the  input  device  due  to  security  conditions.  The  Authorization 
Process  (or  In  the  case  of  an  input  spooling  operation,  the  Unit 
Record  Process)  will  inform  the  NKCP  that  it  is  not  needed. 
However,  due  to  the  inherent  asynchronicity  of  the  system,  the 
NKCP  may  have  become  useful  by  one  trusted  process  even  as  another 
was  deciding  it  was  not  really  needed.  Thus  the  meujage  to  ths 
NKCP  should  be  Interpreted  ae  "Perhaps  If  you  have  no  work  to  do, 
you  may  purge  yourself,"  rather  than  an  imperative  command,  "Purge 
yourself!"  It  is  up  to  the  NKCP  to  make  the  request  of  the 
Authorization  Process  which  causes  the  actual  purge  of  the  NKCP. 

Any  time  an  NKCP  discovers  that  It  has  no  work  to  do  (l.e.,  it  has 
completed  all  of  its  tasks  and  nothing  remains),  it  should  request 
that  it  be  purged  from  the  system,  by  sanding  a  message  to  the 
Authorization  Process.  The  Authorization  Process  attempts  to 
purge  the  NKCP.  If  the  NKCP  cannot  be  purged,  the  Authorization 
Process  returns  a  message  to  the  NKCP,  which  should  then  abort. 
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Operator  Procaaa 
-  Requests  - 

AUTOLOG 

QUERY 

OASO  - 
LINES  - 
GRAF  - 
SYSTEM  - 
NAMES  - 
USERo  - 
user  Id  - 

raddr  -  traddr  must  ba  non-unit  record  device) 
ALL  - 

SHUTDOWN 

ATTACH  raddr  -  Iraddr  must  be  non-unit  record  device] 
DETACH  raddr  -  (raddr  must  be  non-unit  record  device] 
VARY  raddr  -  [raddr  must  be  non-unit  record  device] 
LOCATE  raddr  -  (raddr  must  be  non-unit  record  device] 
MapUner I d 
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Unit  Racord  Procass 

-  Rmquasts  - 

NeadNkcp 
tlapUser  I  d 

Unit  Racord  Process 

-  Responses  - 

UROev I ceA  1 1 ached 
UROev I ceNot Ava liable 


NKCP  Requests 

Logoff 

Disconnect 

Oetach  raddr  -  traddr  must  be  non-unit  record  device] 
DeetroyMa 

NKCP  Responses 

ResponseToOpRequest 
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3.3.2t  Authorization  Process 
Formal  Specification 


module  AuthProeass 
tgpe 

DevIceAddreae, 

LlneAddress, 

ProcessName, 

Vlrt.  lachlneNeme, 

Vo  I  um •. .  J, 

CommandName  -  (AUTOLOG,  ATTACHE ADOR,  OETACH*-RAODR,  VARY*£NLINE, 
VARY«-OFFL  I NE ,  QUERY«-DAS0,  QUERY*-LINES,  QUERYrGRAF, 
QUERY«-NAf1ES,  QUERY-USERS-X.  QUERY^LL,  QUERY^SYSIEIVRAOOR, 
QUERY-RAOOR,  QUERYMJSERS*4JSERI0,  QUERY4JSERI0, 
LQCATE«-RADOR,  SHUTOOUN) , 

CatBa  -  T"  (QUERY«-0AS0,  QUERY4.1NES,  QUERY4SRAF,  QUERY«-NAMES, 
QUERY«4JSERS-X,  QUERY*-ALL) , 

CatSb  -  T"  (QUERY«-SYSTEM«-RAOOR,  GUERY«-RA00R) , 

CatSc  -  TH  (QUERY44JSERS*LISERI0.  GUERY4JSERI0) , 

MeasageNames 

constant 

□on i nates (ProcessName,  ProcessName) i  boolean, 

Oev  i  ceTyps  (Dev  I  ceAddress)  »  Dev  I  csTupes, 

#Cy  I  i riders  (Volume Id)  t  T"I »  integer  (0<l ) , 

Raddr (Str I ng) :  Oev I ceAddress. 

Laddr (String) t  Devi ceAddress, 

MsgName (String) t  MessageNamea, 

OpProcess,  URProcess,  NetuorkProcees,  AuthProcessi  ProcessName, 
TrustedProcessest  S"  (OpProcess,  URProcess,  AuthProeass) 

constant 

AddressSpaceSIzes  T" I :  integer  (0<-l  8  I <-8191?, 

CodeSizet  T" I i integer (0<-I  &  I <-8191), 

Code:  integer, 

MlaxCyl Inders:  T" I  i  integer (I >8) , 

/WlaxRetr last  THI j integer ( I >— 0) , 

#T1axNkcps»  T"I » Integer  (I>-8) , 

/WlaxVIlsi  T"I :  Integer  ( I >— 0) 
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typa 

Raque* {Category  -  (Attach,Clearline,ReDirectLine,l4r I teAndReadLlna, 
OpRequa  >  t ,  NeuVM ,  Connec  t  VM ,  haull  ear , 

Ne wQrConnec  t edVM  .Rail  nou  i  shOa  v  lea), 

ResponaeStatue  •  (NoPeaponae, Responded), 

AccaaaModaa  -  (Read.Wrl te) , 

LtnaStatua  «  (Ratry, Disabled, Aval  labia, Raadlnl  tialPaaaword, 

ReadAccaasPaeaword,  Par  f  ormfiaaourcaChacka,  Hook  I  ngPar  I  phara )  a, 
Notify!  ngNkcp, A 1 1 ached,  RaadL  I  nkPasauor  d,  ReEnab  I  aPand  I  ng) , 

SharablaOr  IvaStatua  •  (Of fLIna, Aval  labia, AttachadToSyatam) , 

OriveStatua  -  (Of  fUna.OatachPandlng, AttachadToUaar, Aval  labia) , 

VolumaStatue  -  (Noun  tod,  Not  Mount  ad) , 

UnhAcceas  -  (R,RR,U,UR,M,f1R,nU), 

L  i  neCond 1 1 1  on  •  T"  (01  sab  I  ad.  Aval  table), 

Act  I  vl  tyStatus  -  (Free, Attached, AttachVal Idation) , 

AccoeaCategory  -  (Logon.Dlal ) , 

ReasonTypea  -  (IncorrectLogon.RaaourcaFai lure.Secur I tyVIoiatlon, 

MaxThroaho  I  dExceeded,  NoNkcp,  NoVM,  Term  InalCl  aarancaM  I  amatch) , 

Logof fRaaaona  •  (UserCholce, Forced, Dlaconnactad), 

DirectoryEntry  ■  structure  of  I 

User  Id  -  Virtual Mach l neName, 

LogonPaaauord  -  String, 

DialPaaauord  »  String, 

,  LinkPaaauord  *  String, 

MaxSacLeval  ■  Proc.isaNana, 

MlnSacLevel  »  ProceaaNama, 

DedicatedOevicea  -  sat  of  DadlcatedOevIceEntry, 

Links  *  aat  of  MOLinkEntry, 

Ip  I  Defined  -  boolean, 

AcceasPaaauorda  -  aat  of  AccaasPasauordEntry) , 
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LlnaEntry  ■  atructura  of  i 
Laddr  «  LlnaAddresa, 
naxSecLaval  -  ProcasaName, 

MlnSacLaval  -  ProcaaaNama, 

Stata  -  Act ! vl tyStatua, 

CyclaPoaltlon  ■  LlnaStatua, 

RequeatedSacLeve I  ■  ProcaaaNama, 

At tachadVM  -  VlrtualflachlnaNama, 

Connaction  -  AccaaaCatagory, 

LlnaDropped  ■  boolaan, 

^Retries  ■  0. .tflaxRatr lea, 

0Aua I t I ngHooks  -  nonnegative  Integer, 
hag  ■  String), 

NkepEntru  »  atructura  of  ( 

Process  ■  ProcaaaNama, 

Vtta  »  eat  of  VflEntry,  ,  _  A 

AttachadOavicas  -  eat  of  AttachedOeviceEntry, 
Links  •  aat  of  MDLInkEntry), 

AccessPasauordEntry  -  atructura  of  ( 

SecLevel  •  ProcaaaNama, 

Password  ■  String), 

VMEntry  -  structure  of  ( 

VhNama  «  VirtuainachlnaNama, 

Laddr  -  LlneAddraaa, 

Dlaconnacted  ■  boolaan, 

Users  ■  set  of  LlneAddraaa), 

DadlcatedOeviceEntry  «»  atructura  of  ( 

Raddr  -  OevicaAddresa, 

VolSacLeval  -  ProcaaaNama, 

Access  -  set  of  Accsssnodas) , 

AttachadDaviceEntry  ■  structure  of  ( 

Raddr  -  DevicoAddrass, 

Access  »  set  of  Acceasnodas) , 

nOLinkEntry  ■  structure  of  ( 
hOName  -  niniOlakNams, 

Access  •  set  of  Accassnodas) , 

ProcessLinkEntry  -  structure  of  ( 

Process  ■  ProcassNams, 

Access  «  set  of  Acceasnodas), 

URPOunedOevIceEntry  »  structure  of  ( 

Raddr  »  DevlceAddress, 
naxSacLsval  ■  Pr ocaasName, 
ninSacLaval  ■  ProcassNams), 


Corporation 

6062/101/00 
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(Forma \t 


etem  Development 
TM- 


NonsharsbleOr IveEntry  »  structure  of  ( 
Raddr  ■  OaviceAddreaa, 
MaKSeoLevel  -  ProcessName, 
mnSecLavel  »  ProcaesNama, 
Stata  •  OrivaStatua, 

At tachedProceaa  -  ProceaaNama, 
Accaaa  •  set  of  AccaaaModaa) , 

Sharab I eOr i veEntry  «  structure  of  ( 
Raddr  ■  OaviceAddreaa, 

State  ■  Sharab I eOriveStatua, 
SecLevei  -  ProceaaNama, 
noun tedVo luma  -  Volumald), 

SharedVo I umeEntry  ■  structure  of  ( 
Volume  ■  Volumald, 

SecLevei  «  ProceaaNama, 
noun tedOev ice  »  OeviceAddreaa, 
State  •  VolumeStatua), 


MlnlDI skEntry  •  structure  of  l 
nOName  -  fi  i  n  i  0 « skNama, 

ContainingVolume  «  Volumald, 

Cylinders  «  T" I ! Integer (1<-I  8 
_  i  .  T"I t Integer (1<»I  8 
SecLevei  ■  ProceaaNama, 

CurrentLinks  «  set  of  PrcceseLlnkEntru, 
AccessControlLi at  -  set  of  ACLEntry), 


I<»W1axCyl indera) 
Ic-dTtaxCyl  indera) 


ACLEntry  -  structure  of  ( 

User  m  VirtualflachineName, 
Access  •  set  of  Accesanodea) , 


Responses  lot  -  structure  of  ( 

Respondent  ■  ProceaaNama, 
Text  ■  String, 

State  -  ResponseStatus) , 


PendlngRequest  -  structure  of  ( 
flsgld  -  Hesaageld, 

Kind  -  RequeatCategory, 

Command  •  CommandName, 

Responses  ■  set  of  Responses  lot) 


Corporation 

-JS2/101/00 
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var I  able 

0Nkcps:  NkcpRange, 
tfVMs:  VMRange, 
tfUsers:  UserRange, 

Shutt ingDown:  boolean, 

URPOunedOe vices:  set  of  URPOunedOaviceEntru, 
Nonsharab  I eOr  ives:  set  of  Nonsharab I eOr  I vecntry, 
SharableOr  I  vest  set  of  SharableDr  iveEntry, 
SharedVo fumes:  set  of  SharedVolumeEntry, 
Minidisks:  set  of  MlniDi skEntry, 

CurrentNkcpa:  set  of  NkcpEntry, 

Lines:  set  of  LineEntry, 

UserOi rectory:  set  of  DlrectoryEntry, 
PendingRequests:  sat  of  PsndingRequast 


I 
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initial 

INkcps  ■  0 
8 

#Vf1s  -  0 
4 

#Ueere  ■  0 
& 

(~ShuttingOoun) 

8 

A"NSt  Noneharab  I  eOr  i  veEntry  (NS<: Noneharab  I  eOr  I  ves  -> 

NS. State  -  Available 
8 

NS.AttachedProcess  -  AuthProcese) 

8 

A"StSharableOr  1  veEntry  (ScSharab  I  eOr  Ivea  -> 

S. State  -  Aval  table) 

8 

AHV:SharedVolumeEntry(V<»SharedVolumee  -> 

V. State  -  Notflounted) 

8 

AThfliniOl  akEntry(f1<:Mlni01ake  -> 

M.CurrentLinke  •  Empty) 

8 

CurrentNkcpe  ■  Empty 

8 

A"L»LineEntry  (LcLInee  -> 

L. State  -  Free 
4 

L.CyclePoel tion  «  Available  I 

L.AttachedVM  -  AuthProcees) 

8 

PendlngRequeets  -  Empty 
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invariant 

tfNkcps  <-  /WlaxNkcpa 

& 

0VHa  <-  OTIaxVtls 

& 

flUsare  <-  tfflaxUsera 
& 

I  nvar i an tsOfURPOunedDev i cas 

& 

I  nvar  i  an  t  sOfNonsharab  I  eOr  i  ves 
ft 

I  nvar i an t sOf Sharab I eOr i ves 
ft 

I  n«ar I  an  t  sO f Shar edVo I umes 
ft 

Invar  lantsOffliniOisks 

ft 

I  nvar  i  antsOfCurrentNkcps 

ft 

I nvar i an  t  sO  f L i nes 

ft 

Invar  I  ant  sOf  Pend  ingRequesta 

ft 

I  nvar  I  an tsOfUearOi  rectory 
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Invar  I  ant sOf URPOwnedOev ices  - 

AHU1 , U2i URPOwnedOev I ceEn  try ( 

Ul<tURP0wned0a  vices  8  U2<:  URPOwnedOev  Ices  -> 
(Ul.Raddr  -  U2.Radclr  ->  U1  -  U2)) 

ft 

AMU>  URPOwnedOev  i  ceEn  try  (U<:  URPOwnedOev  I  cea  -> 

Dominates  (U.  flaxSecLavel  .U.fllnSecLavel ) 
ft 

Oe v  I  ceT ype (Raddr )  <i  S" (Reader , Pr I n tar , Punch , T apeOr I va ) i 
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Invar  I  ant cOf Nonaharab I eOr I vaa  - 

A"NS1 , NS2 1  Nonaharab I aDr I veEn  try  ( 

NS1 <: Nonaharab I eOr I vaa  8  NS2<« Nonaharab I eOr I vee  -> 
(NSl.Raddr  -  NS2.Raddr  ->  NS1  -  NS2) ) 

8 

A " NS i  Nonaharab  I  aDr  I  veEntry  (NS<t  Nonaharab  I  aOr  I  vaa  ,-> 

Doe  i  nataa  (NS.  MaxSacLava  I ,  NS.  M  i  nSacLava  I ) 

& 

(NS. State  ■  Attached  -> 

E"N«NkcpEntry (N<»CurrentNkcpa  8 
N.Procaaa  •  NS.AttachedProceaa 
8 

Don  I nataa (NS. MaxSeeLave I , N. Proceaa) 

8 

Oom  I  nataa (N. Proceaa. NS. M I nSacLava I ) 

8 

E" A i  A 1 1 achedOav 1 caEn try (A<i N. A t  tachodOev I caa  8 
A.Raddr  -  NS.Raddr)))) 
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Invar  i  ant  sOf  Sharab  I  aOr  Ives  - 

AMS1,S2: Sharab I eDr iveEntry(Sl<tSharab|eOr Ivea  A  S2<: Sharab I eDr Ives  -> 
(Sl.Raddr  ■  S2.Raddr  ->  SI  ■  S2) ) 

"St  Sharab  I  aOr  I  veEntry  (S< j  Sharab  I  aOr  I  vaa  -> 

(S. State  -  AttachadToSyitan  -> 

E"V: Shared Vo  I umaEntry (V<t  SharadVo I umaa  A 
V. Vo  luma  -  S. Mount ad Vo  luma 
A 

V. State  ■  Mounted 
A 

V.MountedOevIce  ■  S.Raddr 

A 

Oom I  nates (S. SacLeve I , V. SacLeva I ) )) ) 


t 
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Invar i ant sOf SharadVo lumaa  - 

A"V1,  V2t  SharadVo  I  umeEntry(Vl<t  SharadVo  lumaa  ft  V2<tSharadVo lumaa  -> 
(VI.  Vo  luma  -  V2.  Vo  luma  ->  VI  -  V2)) 

ft 

A"V: SharadVo I umaEntry (V<j SharadVo lumaa  -> 

(V. State  •  Mounted  -> 

E"StSharablaOr  i  veEntry  (SoSharablaOr  ivaa  ft 
S.Raddr  •  V.MountedOevice 
ft 

S.  Noun tad Vo  luma  -  V. Volume 
ft 

S. State  -  AttachadToSgetea 
ft 

□am  I  nates (S. SecLeve I , V . SacLave I ) ) ) ) 
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3,3.2  Authorization  Process  (Formal)  TH-6062/1 01/88 


Invar  I antsOftliniOlsks  ■ 

A"M1 , H2iHl niDI skEntry (flloMi  nlOi  sks  8  M2<)HlniDI ska  -> 
(til . tlOName  -  nZ.flDName  ->  til  -  M2) ) 

8 

AHt1ilHnl01skEntry(t1<)t1inlDIsks  -> 

E " V » Shar edVo  I  umeEn tr y  ( V< :  SharsdVo  I  umaa  8 
V. Volume  ■  tl.ContalningVolume 

8 

Dominatea(V.SeeLevel .H.SecLevel ) ) 

8 

H.Cy  1 1 nder s. 2  >  tl.Cy  I  inders.l 
8 

tl.Cy  I  inders.  1  <  #Cy  I  i  ndersdl.  Contain  I  ngVo  luma) 

8 

tl.Cy  I  inders.  2  <-  #Cy  I  inders  (tl.ContalningVolume) 

8 

A"CiProcessLinkEntry(C<it1.CurrantLlnks  -> 

C. Access  Empty 
8 

EMN:NkcpEntry (N<» Curran tNkcpe  8 
N. Process  ■  C. Process 
8 

E"L:f10LlnkEntry (L<sN. Links  8 
L.tlDName  -  fl.  tlOName 
8 

L. Access  •  C. Access) 

8 

E"A:ACLEntry(A<!t1.Acca8sControlUst  8 
E"Vj  VMEntry (V< j  N. VHs  8 
V.VtIName  »  A. User)) 

8 

(Write  <t  C. Access  -> 

N. Process  «  tl.SecLsvel ) ) ) 

8 

(tl.CurrentUnks  *<■  Empty  -> 

E" V t  Shar edVo I umeEntry (V<t  SharsdVo I umes  8 
V. Volume  -  tl.ContalningVolume 

8 

V. State  »  Hr  unted 
8 

E"S t  Shar ab I eOr i veEn try (S<  s  Shar ao I eDr I ves  8 
S.Raddr  -  V.HountedOevice 
8 

S.HountedVolume  -  V. Vo  luma 
8 

S. State  -  AttachedToSystem) ) ) 


21  flay  1978  Sustain  Davelopmant  Corporation 

3.3.2  Authorization  Procaaa  (Formal)  TM-S0G2/1 01/80 


A " A1 , A2 » ACLEn  tr y ( 

Aicjfl.AccaasContreiLiat  8  A2<:f1.  AccaaaControILl  at  -> 
(Al.Usar  -  AZ.Usar  ->  A1  -  A2) ) 

8 

A"Ai ACLEntry{A<jM.AccaaaControlL» at  -> 
E"DiOiractoryEntry(D<jUsarDiractory  8 
O.Uaarld  «  A.Uaar) 

8 

A.Acceaa  <—  Empty)) 


>0* 


21  flaw  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  Tfl-6065/ 101/88 


Invar lan tsOf Cur rentNkcps  ■ 

AHNl,N2tNkcpEntry(Nl<iCurrentNkcp*>  &  N2<»CurrentNkcpe  -> 

(Nl. Process  •  N2. Process  ->  N1  ■  N2) ) 

"NiNkcpEntry (N<jCurrentNkcps  -» 

■  A"Vf11 , Vf12:  VHEntry (Vf11<:  N. Vfls  &  VH2<iN.VHa  -> 

(Vfll . VfIName  -  Vf12.  VfIName  ->  VfU  -  VPI2) ) 

ft 

A"A01 , A02:Attached0eviceEntry( 

ADlcN.  AttachadDevlces  ft  AD2<iN. AttaehedOevIcae  -> 
(ADl.Rcddr  -  AD2.Raddr  ->  ADI  -  AD2) ) 

ft 

A"L1  ,L2:lTDLInkEntry(Li<jN. Links  ft  L2<sN.LInke  -> 
(Ll.MOName  -  L2.f10Name  ->  LI  -  12)) 

ft 

A" vn» VflEntry (VflcN. VUs  -> 

E"DjOlrectoryF’itry  (0<jUaer0 1  rectory  ft 
0.  User  Id  -  V,  VfIName 
ft 

Oom I  nates (D. HaxSecLeve I . N. Process) 
ft 

Oom I nater (N. Process, 0. Ml nSacLeve I ) ) 
ft 

(Vfl.DI  sconnected  -> 

AMLsLlneEntry (LcLInes  -> 

(L.AttachedVfl  -  Vfl.  VfIName 
ft 

L.RequestedSecLavel  -  N. Process 
ft 

L. State  -  Attached)  -> 

L. Connect  I  on  Logon!) 

ft 

( (^Vfl.DI sconnected)  -> 

E"L: L 1  neEntry (LcLInes  6 
L.Laddr  •  Vfl.Laddr 
ft 

L.AttachedVfl  -  Vfl.VTIName 

ft 

L.RequestedSecLavel  -  N. Process 

ft 

L. Connect  I  on  »  Logon 

L. State  <:  S" (AttachVal Idat Ion, Attached) ) ) 


21  May  1978  Sustain  Development  Corporation 

3.3.2  Authorization  Procass  (Forma!)  171-6862/181/10 


A"UiLlneAddreaa(U<iVM. Users  -> 

EHL:LlneEntry (LciLines  8 
L.Laddr  ■  U 

& 

L.AttachadVfl  -  Vn.VIINamt 
8 

L.RequastadSacLaval  -  N.Procsae 
8 

I, Connection  •  Dial 
8 

L. State  <»  S" (AttachVal idation, Attached) ) 

U  <—  VM.Laddr) ) 

8 

A" ADi  A t  tachedOev  i  ceEn try  (A0< » N.  A t  taehedOev  i  ees  -> 

E "NS s Nonehar ab i  eOr  i  veEntry (NS<i Nonehar ab  i eOr  i ves  8 
NS.Raddr  -  AO.Raddr 
8 

□om i na  t ee (NS . MaxSecLeve I , N. Procass) 

& 

Dominates (N. Process, NS. MinSecLevel ) ) 

A 

AO. Access  «*■  Empty) 

A"L:f1DLinkEntry(L<:N.Links  -> 

E"fl5f1ini0iskEntry(f1<irilniDisks  8 
fl.flOName  -  L.HDName 
8 

Dorn  I  nates (N. Process, M. SscLsvs  I ) 

8 

E"C5ProceaeLlstEntry(C<j[1.CurrentLlnkB  8 
C. Process  ■  N. Process 
8 

C. Access  *  L. Access) 

8 

E"AiACLEntry(A<iM. AccessControlLi  st  8 
E"Vflj VHEntry  (YftcjN. Vfls  8 
Vfl.VMName  -  A. User)) 

8 

(Unite  <»  L. Access  -> 

N.SecLevel  ■  N, Process)) 

8 

L. Access  —  Empty)) 

A"Nl,N2:NkcpEntry(Nl<:CurrantNkcps  8  N2<:CurrentNkcps  -> 

A " A01 , A02 : A  t  tachedOev i ceEn  try ( 

AOloNl.  At  tachedOev  ices  8  A02<»N2.  At  tachedOev  ices  -> 
AOl.Raddr  AdZ.Raddr)) 
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21  flay  1978  Suatem  Development  Corporation 

3.3.2  Authorization  Procaaa  (Formal F  TM-60G2/ 101/00 


Invar  I  ant aQfL I  nee  ■ 

A"Ll,L2:LlneEntru(Li<jLlnea  8  L2<»Llnaa  -> 

(Ll.Laddr  ■  L2.Laddr  ->  Li  ■  12)) 

A 

A"L»LineEntry(L<*Llnea  -> 

Oom  I  na  taa  <L .  flaxSacLava  I ,  L.fll  nSacLava  I ) 

8 

(L. State  -  AttachVal Idatlon  -> 

L.CyclaPoal tlon  <i  SH (Retry. Raadlni t lalPaeaword, 

ReadAceeeaPaaauord, Hook  I ngPor I phara I  a, 
NotlfyingNkcp)) 

(L. State  Attached  -> 

L.CyclaPoal 1 1 un  <t  S" (Attached, RaadLInkPaaauord)) 

8 

(L. State  »  Free  -> 

L.CyclaPoal tlon  <i  SH (Dlaab fed, Aval lable.ReEnablePandlng) ) 

(L. State  <t  S" (At tachVal idatlon, Attached)  -> 

Oom  I  net aa  (L .  MaxSeeLeve  I , L.  Requaa  tadSacLeve  I ) 

8 

□om  i  na  t ea  (L .  Requaa  tadSacLeve  I ,  L.  fl  I  nSecLeve  I ) ) 

8 

(L. State  ■  Attached  -> 

E"Nt NkcpEntry (N<i Curran tNkcpa  8 

N. Procaaa  -  L. Requaa tadSacLeve I 
8 

E"Vf1:  VMEntry  (Vf1<J  N.  Vila  8 
vn.VMName  -  L.AttachadVM 
8 

(L. Connect  I  on  •  Logon  -> 

Vh.Laddr  -  L.Laddr 

8 

~Vf1. 0 1  aconnec  ted) 

8 

(L. Connection  •  Dial  -> 

E"U:LineAddraaa(U<jVn.Uaera  8 
U  -  L.Laddr)))))) 


21  May  1378 

3 .3.2  Authorization  Prcceee 


a.-' 

(Formal) 


Oavalopmant  Corporation 
171-6862/101/38 


A"Ll,L2»UneEntry(Ll<»Llnea  6  L2<uLinee 
(Ll.Raddr  -*•  L2.Raddr 

A 

LI. State  ■  Attached 

6 

L2. State  •  Attached 

8 

LI. Attached VII  .  L2.AttachedVI1 

Ll.RequeetedSecLevel  »  L2.RequeetedSecLevel 
8  * 

LI  .Connect  I on  -  Logon)  -> 

L2. Connect  Ion  ■  Dial) 


21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-6062/101/08 


Invar  I  ant sOf Pend IngRaquests  ■ 

A  "PI,  P2j  Pend  I  ngRequest  (Pic  Pend  IngRaquests  &  P2cPendlngRequasts  -> 
(Pl.Hsgld  ■  P2.f1sgld  ->  Pi  ■  P2) ) 

8 

ATiPendingRequest  (Pc  Pend  IngRaquests  -> 

A"Rl,R2:ResponseSlot (HlcP. Responses  8  R2<:P. Responses  -> 

(R1  .Respondent  -  R2. Respondent  ->  R1  ■  R2)) 

8 

EHR:  Responses  lot  (RcP.  Responses  8 
R. State  -  NoResponse) 

8 

P. Responses  «»»  Empty) 
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21  Nag  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TM-6062/101/08 


Invar i ant sOfUeerOi rectory  ■ 

A"Dl,02iD}rectoryEntry(01<iUser0irectory  4  D2<sUserDi rectory  -> 

(01.  User  Id  -  02.  User  Id  ->  D1  -  02)) 

4 

AHDi  0  i  rec  toryEr.  try  (0<»  UserQ  I  rectory  -> 

Dominates  (0. MaxSecLeve I  .D.MinSecLevel ) 

4 

A"D01 ,002j0edicated0eviceEntry ( 

DDlcD.OedlcatedOevices  4  002<:0.0edicated0evices  -> 

(OOl.Raddr  ■  D02.R^ddr  ->  DD1  •  002)) 

4 

AmDOj  Oedl  catedOev  i  ceEn  try  <□□<:  0.  Oedi  catedDev  I  css  -> 

(DevlceType(DO.Raddr)  <:  S" (Reader, Printer, Punch,  TapeDrlve)  -> 
E"Ui URPOunedOev i ceEn try (U<i URPOunedOev i ces  4 
OO.Raddr  ■  U.Raddr 
4 

(OeviceType(OD.Raddr)  ■  Reader  -> 

DO. VolSecLevel  -nil 
4 

00. Access  -  S" (Read) ) 

4 

(OeviceType(OO.Raddr)  <*  S* (Printer, Punch) -» 

00. VolSecLevel  -  ni I 
4 

00. Access  -  S* (Ur its)) 

4 

(OevicoType(DO.Raddr)  -  TapeUrive  -> 

Oom i na  tea (U. MaxSecLeve I , DO.  Vo  I SecLeve I ) 

4 

Oom i nates (DO. Vo  I SecLeve I ,U.MInSecLevel ) 

4 

Oom i nates (0. MaxSecLeve I , DD. Vo  I SecLeve I ) 

4 

DD. Access  Empty))) 

4 

(DevlceType(OO.Raddr)  ~<r  S" (Reader, Printer, Punch, TapeDr  Ive)  -> 
E"NS: Noneharab I eOr i veEntry (NS<:  Nonsharab I aOr I ves  4 
NS.Raddr  -  OD.Raddr 
4 

Dominates (NS. MaxSecLeve I , DO. Vo  I SecLeve I ) 

4 

Dominates (DO. VolSecLevel .NS.MinSecLevel ) 

4 

Oom i nates (0. MaxSecLeve I , DO. Vo  I SecLeve I ) 

4 

00. Access  Empty))) 

4 


/ 
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21  flay  1378  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TPI-80G2/101/00 


A"Ll,L2sflOLInkEntry(LlcO. Links  8  L2<:0. Links  -> 
(Ll.nDName  -  L2.flOName  ->  LI  -  L2)) 

8 

AHL)flOLinkEntry  (LcD. Links  -> 

EHf1tHini0i8kEntry(n<)f1inlDisks  8 
M.tlONama  -  L.flONaae 
8 

E" A: ACLEntry (Ac H. AccassContro I L i  st  8 
A. User  ■  □.Userid 
8 

L.  Access«-A.  Access) 

8 

Oominatea(D.MaxSecLevel  .fl.SecLevel ) ) 

8 

L.  Access  *>■  Empty) 

8 

A" API , AP2*  AccessPasauordEn try ( 

APlcO.AcceasPassuords  8  AP2<:0.AccesePas8Uorda  -> 
(API .  SecLeva I  -  AP2.SocLeval  ->  API  -  AP2) ) 

8 

AHAPt AccesaPaaauordEntryiAPcO.AccaaaPaaauords  -> 

Don i nates (0. MaxSecLeve I , AP . SacLave  I ) 

8 

Dorn  i  na  tea  (AP.  SecLeva  1 , 0.  til  nSecLave  I ) ) ) 


21  May  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  171-6062/1 81/00 


NTUKli  Network  process  message  re  line  status  (both  request  and 
response) 


transform  NTUK1 (Laddr:  LlneAddress, 

CurrentLineStatus:  LlneCondition) 

effect  (~(E"L»LineEntry(L<:Lines  8 

L.Laddr  -  Laddr)) 

->  Error  <>  NoError  & 

E"LiLineEntry(L<: Lines  8  L.Laddr  •  Laddr  8 
NMLines  -  Lines  S"  (L)  II 
S"  ( (L.Laddr, 

L.flaxSecLevsl , 

L.MinSecLevel , 

/■titttt*/  (L. State  ■  Attached 

I 

(L. State  -  AttachVal idaticn 

8 

L.CyclePosi t I on~<:S" (HookingPeriphera's, 

Not! fylngNkcp) )  -> 

Free 

<>  L. State), 

/ itUUit/  (L. State  »  Attached 

I 

(L. State  -  AttachValidation 

8 

L.CyclePosi  tiorwcS"  (HooklngPerlpherale, 

Not  I fylngNkcp) )  »> 

CurrentLineStatus 
<>  L.CyclePosi tion) , 

L.RequastedSecLevel , 

/ itttUi't/  (L. State  »  Attached 

I 

(L. State  -  AttachValidation 

8 

L .  Cyc  I  ePos  i  1 1  on~<:  S"  (Hook  i  n<  .Per  I  pher a  1  s , 

Noti  fy  ngNkcp) )  ■> 

AuthProcess 
<>  L. Attached Vh) , 

L. Connect  Ion, 

/*££*/  (L. State  ■  AttachValidation 

8 

L.CyclePosi  t  ioncS"  (HookirgPer  Iphera I s,Not I  fylngNkcp) 
true 

<>  L .  L  i  neOr  opped) , 

L. /(Retries, 

L.JVAuai  tingHooks, 

L.lisg) ) 
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21  flag  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  Tfl-6062/1 81/00 


(L. 


/ft##*/ 


State  -  Attached  -> 

E"N:NkcpEntry ( 

NcjCurrentNkcps  8  N. Process  •  L.AttachedProceee 
EHV:Vnentrg(V<:N.Vf1a  8  V.VMNam*  -  L.AttachadVfl  8 
N"CurrentNkcps  »  CurrentNkcpe  S"  (N)  M 
S" ( (N. Process, 

N.  Vfle  S"(V)  II 
S"  ( (V. VMName, 

V.Laddr, 

(L. Connect  I  on  -  Logon 

8 

L.Laddr  -  V.Laddr  •> 


true 

<>  V.DI aconnected) , 

/ft##*/  (L. Connect  I  on  •Dial 

8 

E"UiLlneAddreaa(U<j V.Uaera  8 
U  »  L.Laddr)  •> 

V.Uaera  ~~  S" (L.Laddr) 

<>  V.Uaera))), 

N. A t  tachedOev I cea, 

N. Links)))) 

8 

Kerne  ICa  1 1  ed  (Sendfleasage  (OpProceea) ) 

<>  Kerne  (Called  (Sendflesaage  (Process) ) ) ) ) 


8 


> 
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21  Flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  171-6062/101/80 

LG0L1:  Network  Procaaa  message,  LOGON  or  DIAL  request  received 


transform  LGOLKLaadrt  LineAddrese, 

AttemptedCommandi  AcceasCategory, 

Userid:  Virtue inachlneNaee. 
RequestedStcLevel :  ProceeeName) 

effect  (<v(E"LiLine£ntry(l.«.-i Lines  & 

L.Laddr  -  Laddr 
8 

L. State  -  Free 
8 

L.CyclePoai tion  ■  Available)) 

->  Error  <>  NoError  8 
E"L:LineEntry(L<:Lines  8  L.Laddr  »  Laddr  8 
N"Lines  »  Lines  «<•*  S"(L)  II 
(Don  i  na  tee  (L.  naxSecLeve  I ,  Requee  tedSecLeve  I ) 

8 

Oominates(RequestedSecLevel .L.ninSecLevel )  ■> 
SM( (L.Laddr, 


/*Mt</ 

L. naxSecLeve 1 , 
L.ninSecLevel , 
AttachVal Ida tion. 

/*M*/ 

Readlni tiaiPassword 

/*M*/ 

Requee tedSecLeve 1 , 

Userid, 

A  t  temp  tedCoeiMMid, 

/*M*/ 

/*M*/ 

false. 

/*M*/ 

0, 

/ft***/ 

0. 

/ *Utt */ 

nil)) 

<> 

S"(  (L.Laddr, 

/****/ 

L. naxSecLeve  1 , 
L.ninSecLevel , 

Free, 

/**#*/ 

ReEnab 1 ePend i ng, 

/*M*/ 

L . Requee tedSecLeve 1 
AuthProcess, 

8 

L. Connect  ion, 
L.LineOropped, 
L.*Retr lee, 

L.FAuai t ingHooks, 
L.nsg))) 
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21  May  1978  Suatan  Davalopmant  Corporation 

3.3.2  Authorization  Procsa*  (Fornal)  TM-6062/101/80 


fTPandlngRaquanta  -  PandingRaquaata  II 
5" l (NauMsgld, 

/*##*/  (Don  I  nataa  (L.  PlaxSacLava !  .RaqueatadS*  d-aval ) 
ft 

Don  i  na  t  ea  (Raquaa  t  adSacLava  I ,  L .  ft  I  nSacLava  I )  -> 

Ur i taAndRaadL i na 
<>  C I aarL i na) . 

/ittttt*/  Unda  f  i  nad , 

5" ( (NatuorkProceaa, 
nil, 

NoAwaponaa) ) ) ) 
ft 

(Don  i  nataa  (L.llaxSaeLavn  I ,  Raquaa  tadSacLava  I ) 
ft 

Doninataa(RaqueatadSaeLaval , L.  M  i  nSacLava  I )  »> 

Kama  ICa  1 1  ad  (Sandfleeaaga  (NetuorkProcaaa) ) 

<>  KarnalCal  lad(SandHaaaagetNatwor!\Procaaa) ) 
ft 

Karna  I  Ca  1 1  ad  (Sandflaaaaga  (Na  tMorkProcaaa) ) ) ) ) 


21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-6062/181/80 


LGDL2:  Network  Process  message  (Retry  of  LOGON  or  DIAL) 


transform  LG0L2(Laddri  LineAddress, 

Userid:  Virtual  Mach ineName, 
RequestedSecLevel i  ProcessName) 

refcond  EML:LineEntry(L<:Lines  4 

L.Laddr  -  Laddr 
4 

L. State  -  AttachVal idation 

4 

L.CyclePosition  ■  Retry) 

effect  E"L:Line£ntry(L<:Lines  4  L.Laddr  •  Laddr  4 
N"Lines  -  Lines  —  SH (L)  1 1 
(Oom  i  nates (L.MaxSecLevei .RequestedSecLevel ) 

4 

Dominates (RequestedSecLevel .L.MinSecLsvel )  •> 
S” ( (L.Laddr, 


/ft#**/ 

L.MaxSecLevei , 
L.MinSecLevel , 

L. State, 

Readlni t ialPassword, 

/*##*/ 

RequestedSecLeva 1 , 

/*##*/ 

Userid, 

<> 

L. Connect  ion, 
L.LineOropped, 

L.ARe tries, 

L.#Auai  tingHooks, 
L.Msg) ) 

S" ( (L.Laddr, 

L.MaxSecLevei , 
L.MinSecLevel , 

Free, 

ReEnab 1 ePend i ng , 

/*##*/ 

L. RequestedSecLevel , 
AuthProcess, 

4 

L. Connect  ion, 

L.LineOropped, 

L.tfRetries, 

L. #Aua i t i ngHooks, 
L.Msg))) 
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21  May  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TM-6062/101/00 


N"Pendi ngRequests  ■  Pend i ngRequests  II 
SH  ( (Newflagld, 

/*##*/  (0omlnates(L.f1axSecLevel  .RequestedSecLevel) 

8 

Oom i nates (RequastedSecLeve I , L . M i nSecLeve I )  -> 

Ur i teAndReadL i ne 
<>  ClearLine). 

/*##*/  Unde  fined, 

SH ( (NetworkProcess, 
nil, 

NoResponse) ) ) ) 

8 

(Oomi nates (L.M&xSecLeve I, RequestedSecLevel ) 

8 

□om  i  na  tee  (Reques  t edSecLeve  I ,  L .  fl  i  nSecLeve  I )  -> 

KernelCal  I  edlSendflessage  (NetworkProcess) ) 

<>  KernelCal  I  edtSandflessage  (NetworkProcess) ) 

8 

KernelCal  I  ad (Sendflessage  (NetworkProcess) ) ) ) 
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21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TI1-60SZ/181/88 


LG0L3t  Userid,  password,  and  requested  secur'ty  level  validations 


traneform  LG0L3 (Laddr i  LlneAddress, 

Passwordi  String) 

refcond  E"LiLlneEntry (L<t Lines  A 

C. Laddr  ■  Laddr 
ft 

L. State  •  AttachVal Idatlon 
ft 

L.CyclePoel tlon  -  Readlnl tlalPaasuord) 

effect  E"L «L ineEn try (L<: Linas  ft  L. Laddr  •  Laddr  ft 
N"Llnes  -  Lines  —  S’*  CL)  II 
S”((L. Laddr, 

L.flaxSecLevel, 

L.flinSecLevel , 

/*##*/  ( (E"OjOirectoryEntry(D<»UserOirector*j  ft 

□.Userid  ■  L.AttachadVM 

ft 

((..Connection  -  Logon  -> 

□.LogonPassword  -  Password) 
ft 

(L. Connection  ■  Dial  -> 

D. Dial  Password  *  Password) 
ft 

~ (Oom (nates (0. flaxSecLeve I , L. Reques  tedSecLeve I ) 

4 

I  Dominatea(L. Reques tsdSecLsve I  .D.riinSecLevel ) ) ) ) 

L.#Retries  +  1  •  #HaxRe tries  -> 

Free 

<>  L. State), 
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21  flay  1978  Sustain  Development  Corporation 

3.3.2  Author  I zat Ion  Procaas  (Formal)  TH-6062/101/08 


Av/Mf*/  (EMOtOirectoryEntry (DoUserDt  rectory  & 

O.Uaarid  -  L.  AttaehedVfl 
8 

(L. Connect  ion  ■  Logon  -> 

O.LogonPaaauord  -  Password) 

8 

(L. Connect  ion  "Dial  -> 

D.DIalPaaauord  ■  Paaaword))  -> 

EHD: 0 iractoryEntry (Do UaerD I  rectory  8 
□.Userid  ■  L.AttachedVfl 

8 

(Dominates (O.naxSecLevel .L.RequestedSecLevel ) 

8 

OominateatL.RequaatadSecLavel  .D.fllnSecLevel)  - 
(E" At  AccesePaeswordEntry ( 
AoO.AccessPaasuorda  8 
A.SecLevel  ■  L.RequeatedSecLeval )  »> 
ReadAcceaaPaasword 
<>  Per f or mfleaourceChecKa) 

<>  ReEnablePending) ) 

<>  (L. /(Retries  +  1  ■  /fllaxRe tries  ■> 

ReEnab I ePend I ng 
<>  Retry)), 

L.RequeetedSecLevel, 

/*##»/  ( (E"0:0irectoryEntry (D<tUaerDiractory  8 

0. Userid  •  L.AttachedVfl 
8 

(L. Connect  I  on  »  Logon  -> 

D.LogonPassword  -  Password) 

8 

(L.  Connect  ion  -  Dial  -> 

O.DialPaaauord  -  Password) 

8 

-(Dominates  (O.flaxSecLevel  .L.RequeetedSecLevel ) 

8 

Dominates (L.RoqueatedSecLevel .O.fllnSecLavel )) ) ) 

I 

L. /(Retries  +  1  »  /(flaxRetr  lea  »> 

AuthProceaa 
<>  L.AttachedVfl), 

L. Connect  I  on, 

L.LineOropped, 

/*/(##/  (-(E"0:0irectoryEntry  (Do  UaerO  I  rectory  8 

O.Uaarid  -  L.AttachedVfl 

8 

(L. Connect  ion  •  Logon  -> 

D.LogonPassword  •  Password) 

8 

(L. Connect  ion  -  Dial  -> 

O.DialPassword  -  Password)))  » 

L. /(Retries  +  1 
<>  L. /(Retries) , 

L.//Awai  tingHooks, 
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3.3.2  Authorization  Procsas  (Formal)  Tfl-6062/101/80 


L.Msg) ) 


271 


21  Hay  1978  _  System  Development  Corporation 

3.3.2  Authorization  Proceaa  (Formal)  Tn-6062/101/00 


E"Entryl,  Entry2«PendingRequest ( 

Entryl  -  (Nauttsgld, 

Up  I teAndReadLine, 

Unda fined, 

SM ( (NetuorkProceas, 
nil, 

NoReaponae) ) ) 

8 

Entry2  •  (Neuflagld, 

CiaarLina, 

Undefined, 

S"i  (NetuorkProceas, 
ni  I , 

NoReaponae) ) ) 

8 

N"Pendingr.equeata  ■ 

(E"0t  0 1 rac toryEn try (Do UaerD i rectory  8 
O.Uaerld  -  L.AttachedVM 
8 

(L. Connect  I  on  ■  Logon  -> 

D.LogonPsaauord  -  Paaauord) 

8 

(L.Ccnnection  -  Dial  -> 

Q.OialFaeauord  •  Paaauord))  ®» 
E"OiDirectoryEntry(D<J UaerD I rectory  8 
O.Uaerld  »  L.AttachedYn 
8 

(Doelnatea (D.naxSecLeve I ,L.  RequeatedSecLeve I ) 

8 

Dominates (L.RequaatedSecLevel .D.MinSecLevet )  ■> 
(E”At  AccesaPaesuor  dEntry ( 
AoD.AccaeePaeeworde  8 
A.SecLevel  ■»  L. RequeatedSecLeve I )  ■> 
PandingRequesta  II  S" (Entryl) 

<>  PandingRequesta) 

<>  PandingRequesta  II  S"(Entry2))) 

<>  (L.flRetriee  +  1  «  AflaxRetrlea  ■> 

PandingRequesta  II  S" (Entry2) 

<>  PandingRequesta  II  S" (Entryl) )) ) 
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3.3.2  Author Izat ion  Procaaa  (Formal)  Tfl -6 062/101/00 


(EM0t0lractorg£ntrg(0<iUaar0iractorg  8 
O.Uaarid  -  L.AttachadVM 

8 

(L.Connact ion  *>  Logon  -> 

O.LogonPaaauiQrd  •  Paaauord) 

8 

(L.Connact  I  on  •Dial  -> 

D.OialPaaauord  -  Paaauord)}  »> 
E"D«OlractoryEntry( 

OoUaarOiractorg  8  O.Uaarid  -  L.AttachadVM  8 
(Ooa  I  nata*  (0.  MaxSacLava  I ,  L.  Raquaa  tadSacLava  I ) 

8 

Doa  I  na taa  (L.  Raquast adSacLava  1 , 0.  M I  nSacLava  I )  •> 
(E*Ai  AccaaaPaaauordEn try ( 
AoO.AccaaaPaaauorda  8 
A.SacLaval  ■  L.  Raquaa  tadSacLava  I )  -> 
KernelCal I  ad (SandMaaaaga ( 
NatuorkProcaaa) ) ) 

<>  Kama  I  Ca  1 1  ad  (SandMaaaaga  ( 

NatuorkProcaaa) ) 

8 

KarnelCal I  ad (SandMaaaaga ( 

NatuorkProcaaa) ) ) ) 

<>  (N"L.#Retr iaa  ■  MlaxRatriaa  ■> 

Kama  I  Cal  lad(SandMearaga( 

NatuorkProcria)) 

8 

Kama  (Ca  1 1  ad  (SandMaaaaga  ( 

NatuorkProcaaa)) 

<>  Kama  I  Ca  1 1  ad  (SandMaaaaga  ( 

NatuorkProcaaa) ) ) ) ) 
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3.3.2  Authorization  Process  {Formal)  TH-6062/101/08 

LGOL4:  Perform  access  passuord  checks 


transform  LG0L4(Laddr*  LineAddress, 

AccessPassuord!  String) 

refcond  E*L:LlneEntry (LciLlnas  8 

L.Laddr  ■  Laddr 
8 

L. State  ■  AttachVa! Idat Ion 
8 

L.CyclePosi t i on  -  ReadAccessPassuord) 

affect  EHLiLine£ntry(L<iUines  8  L.Laddr  •  Laddr  8 
(~  (E"Di  0  irec  tor  yEntryfOcUserO  I  rectory  8 
□.Userid  ■  L. User  Id 
8 

E"  A:  AccessPassuordEn try  (Ac  0.  AccessFassuords  8 
A.SecLevel  •  L.RequestedSeuLevel ) ) ) 

•>  Error  <>  NoError  8 

E"0:DirectoryEntry(D<:UeerOirectory  8  D. Userid  -  L. Userid  8 
E" As AccessPassuordEn try ( 

A<:0. AccessPassuords  8  A.SecLevel  »  L.RequestsdSecLevel  8 
N"Lines  -  Lines  —  SM CL)  II 
SM  (L.Laddr, 

L.MaxSecLeve! , 

L.ninSocLevel , 

/*##*/  (A. Passuord  AccessPassuord 

8 

L. /(Tetri  as  +  1  -  /fflaxRetries  -> 

Free 

<>  L. State), 

/*//#»/  '  (A. Passuord  ■  AccessPassuord  -> 

Per  f ormResourceChecks 
<>  (L.#Retries  +  1  »  /fflaxRetries  ■> 

ReEnab I ePend i ng 
<>  Retry)),  . 

1. Roques tedSecLavo I, 

/*////>>/  (A. Passuord  «•  AccessPassuord 

8 

L. /(Retries  +  1  »  ZfltaxRe tr i es  »> 

AuthProcsss 
<>  L.AttachedVll) , 

L. Connect  ion, 

L.LineOropped, 

/itttUit/  (A. Passuord  AccessPaasuord  •> 

L. /(Retries  +  1 
<>  L. /(Retries), 

L.  #Aua 1 1 1 ngHooks, 

L.llag) ) 

8 
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21  flay  1978 

3.3.2  Authorization  Procaas 


Sustain  Development  Corporation 
(Formal )  TM-6062/ 101/00 


(A.AcceasPaaaword  —  Password  •> 

N"Pend i ngRaquaa  t s  -  PendingRaqueats  II 
SH  ( (Newflsgld, 

/*##*/  (L.tfRetrias  +  1  -  /SfflaxRetr lea  ■> 

ClearLine 

,  „  <>  Ur i teAndRaadLIne) , 

/•httffit/  Undefined, 

S" ( (NetworkProcaaa, 
nil, 

NoReaponae) ))) 

<>  N^Pendi ngRaquaa t a  •  PendingRequeata) 

& 

(A. Password  «*•  AcceasPaaauord  -> 

Kerne  I  Cal  led(Sendf1easage(0pProceas) ) 

8 

(L.tfRetrlaa  +  1  ■  tflaxRetriea  »> 

Kama  I  Cal  ad(Sendf1essage( 

>  NfttworkProceas)) 

8 

Kama  I  Cal  I  ad (Senddeaaaga ( 
NetworkProcaaa)) 

<>  Kama  I  Cal  I  ad  (Sendfleaaage  ( 

NetworkProcaaa) ))))))) 

► 
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21  May  1978  System  Development  Corporation 

3.3.2  Author izatlon  Process  (Formal)  TH-S062/181/B0 


LGDL5t  Perform  resource  checks 


transform  LG0L5 (Laddr i  UnsAddress) 

refcond  E*LjLlneEntry(L<jUnes  4 
L.Laddr  ■  Laddr) 

affect  E"LsL  ineEntry  (LcLines  4  L.Laddr  •  Laddr  4 

(~ (E" s  D i r sc toryEn try (D< j  UaerD I rectory  4 
0. User  Id  -  L.AttachedVM) 

4 

~3hut  t i ngOown) 

*>  Error  <>  NoError  4 

E "DjD I rec toryEn tr y(D<tUserDlrectory  4  0. Userid  •  L.AttachedVM  4 
/#  not  specified  */  true')) 
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21  May  1378  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TM-6062/181/03 


LGOLSt  Attach  Dedicated  Devices 


transform  LG0L6(Laddr:  LineAddress) 

refcond  EHL*LineEntry  (LoLines  & 

L. laddr  -  Laddr 
8 

L. State  -  AttachVal idation 

& 

L.CyclePosi t ion  -  HookingPeripherais) 

affect  E"LtLlne£ntry (LoLines  8  L. Laddr  -  Laddr  & 

(<v  (E"Ni NkcpEntry  (No  Curr  entNkcpa  8 

N.  Process  ■  L.AttachedProcess) 

8 

E"D:OirectoryEntry(D<tUaerOlrectory  8 

O.  Userid  ■  L.AttachedVfl) ) 

•>  Error  <>  NoError  8 

E"N; NkcpEntry (No CurrentNkcpa  8  N.Process  -  L.AttachedProceee  8 
E"D:DlrectoryEntry(DoUaarDlrectory  8  D. Userid  ■  L.AttachedVfl  8 
/*  not  epecified  */  true)))) 
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3.3.2  Authorization  Process  (Formal)  TM-G8B2/181/08 


LGDL7i  Perform  Links  at  Logon 


transform  LG0L7 (Laddr j  LlneAddress) 

refcond  E"LtLlneEntry (L<t Lines  8 

L.Laddr  ■  Laddr 

8 

L. State  -  AttachVal Idation 

8 

L.CyclePosi tion  ■  HookingPer ipherals) 

effect  E"L*LineEntry (LciLlnes  8  L.Laddr  •  Laddr  8 
(~(E*NtNkcpEntry  (NcCurrentNkcps  8 

N. Process  ■  L. AttachedProcese) 

8 

E"0t  D I  rsctoryCntry  (DclIserDi  rectory  8 
□.Userid  *  L.AttachedVM)) 

•r»  Error  <>  NoError  8 

E"NsNkcpEntry (NcCurrentNkcps  8  N. Process  »  L. AttachedProcese  8 
EHD:DirsctoryEntry  (OcUserO  I  rectory  8  D.  Userid  *  L.AttachedVM  8 
/*  not  specified  ft/  true)))) 
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21  Mag  1978  System  Development  Corporation 

3.3.2  Authorization  Proceaa  (Formal)  Ttl-6062/1 01/00 

LG0L8:  Response  to  message  to  NKCP  re  neu  Vfl 


transform  LGDL8(Vt1:  VirtualflachlneName, 

Process:  ProcsssNeme, 

Laddri  LlneAddress) 

refcond  E"L:LlneEntry (L<:Lines  8 

L.Laddr  -  Laddr) 

effect  E"L:L I  reentry  (LcLines  8  L.Laddr  -  Laddr  8 
(~(L.  Attached  VII  -  Vfl 
8 

L. State  »  AttachVal Idatlon 
8 

L.CyclePosi t ion  -  Not! fyingNkcp) 

■>  Error  <>  NoError  8 

NMLines  -  Lines  ~~  S" (L)  it 
S’*  {{L.Laddr, 

L.flaxSecLavel , 

L.fllnSecLevsl, 

/*##*/  (Responded (Process)  -> 

Attached 

<>  (AMN:NkcpEntry (N<: Curran tNkcps  -> 
N.  Process  <*•«  Process) 

8 

L.LIneOropped  -> 

Free 

<>•  L.State)), 

/*##*/  (Responded (Process)  ■> 

Attached 

<>  (E"N:NkcpEntry  (NcCurrentNkcps  8 
N. Process  »  Process) 

I 

L.LIneOropped  -> 

L.CyclePosi t ion 
<>  PerformflesourceChecks)), 

L . Reque  s  t  edSecLs ve I , 

L.  Attached  Vfl, 

L. Connect  ion, 

L.LIneOropped, 

L. #Retr ies, 

L  #Aua I t i ngHooks, 

L.flsg) ) 
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3.3.2  Authorization  Process  (Formal)  TI1-63S2/101/00 


(Responded (Process)  ■> 

KernelCal  I ed (Sendflessage (NetuorkProcess) ) 

<>  (E"NtNkcpEntry(N<:CurrentNkcpe  4 
N. Process  «  Process)  »> 

KarnelCal  led  (Sendflessage  (Process) ) 

<>  (L.LIneOropped  -> 

Kerne  I  Ca  1 1  ed  (Sendflessage  ( 

NetuorkProcess) )))))) 


ZS0 


) 
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21  flay  1378  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-B862/101/00 


NKCPIj  Disconnect 


transform  NKCP1 (Process:  ProcessName, 

Vfli  VirtualttachineName, 

Laddr:  LineAddress 
LineAction:  String) 

effect  (~(E'"N:NkcpEntry{N<:CurrentNkcps  4 

N. Process  -  Process) 

4 

E"L:LineEntry(L<: Lines  4 
L. Laddr  ■  Laddr)) 

«>  Error  <>  NoError  4 
E"L:L ineEntry (LcLinea  4  L. Laddr  ■  Laddr  4 
4 

E"N:NkcpEntry (NcCurrentNkcps  4  N. Process  -  Process  4 
N"Lines  -  Lines  ~~  S" (L)  II 
S"((L. Laddr, 

L.MaxSecLevel , 

L. M i nSecLeve I , 

/*##*/  (E"V: VttEntry(V<:N.  Vtts  4 

V. VMName  -  Vtt 
4 

V. Laddr  •  Laddr 
4 

-^.Disconnected)  •> 

Free 

<>  L. Stats), 

/*##*/  (E"  V  iVttEn  try  (VcN.  Vtts  4 

'  V. VfIName  -  Vtt 

4 

V. Laddr  m  Laddr 
4 

^.Disconnected)  •> 

ReEnab I ePsnd i ng 
<>  L.CyclePosi tion) , 
L.RequestedSecLeve! . 

L.AttachedVM, 

L. Connect  ion, 

L.LineOropped, 

L./DRe  tries, 

L.tfAwai tingHooks, 

L.tteg) ) 

4 
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System  Development  Corporation 
(Forma  I F  TM-6062/101/00 


N"0Ueers  - 

(E"V»  VMEn  try  (V<tN.  Vfls  8 
V .  VMName  -  VM 

8 

V.Laddr  ■  laddr 
8 

-V. Disconnected)  •> 
tfJaers  -  1 
<>  Wears) 

8 

NTendingRequesta  - 

TE"V j  VMEntry (V<:  N. VUs  8 
V.VMName  -  Vfl 
8 

V.Laddr  -  Laddr 

8 

^.Disconnected)  »> 

PnndingRequests  II 
S" ( (NeuMaald, 

(LineAction  -  ’hold’  -> 

ReOirectLIne 
<>  ClearLIne), 

Undefined, 

S" ( (NetuorkProcesa, 
nil, 

NoResponee) ) ) ) 

<>  PendingRequeets) 

(E"Vi VMEntry (V<iN.VMs  8 
V.VMName  -  VM 
8 

V.Laddr  «  Laddr 

8 

••V, Disconnected)  -> 

E*VjVMEntry(V<:N.VMs  8  V.VMName  -  Vfl  8 
V.Laddr  ■  Laddr 

8 

V.Di sconnected) 

8 

N"CurrentNkcps  -  CurrentNkcpe  —  S" (N1  I  I 
S"  ( (N. Process, 

N.VMs  SMV)  1 1 
S"(  (V.VMName, 
v.Laddr, 
true, 

V. Users)), 

N. AttachedOevices, 

N. Links) ) ) } 

& 

Kerne (Called  (SsndMessage (NetuorkProcess) ) ) ) ) 
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System  Development  Corporation 
(Forma  I )  TM-6062/l 81/00 


NKCP2s  Logoff 


transform  NKCP2 (Process:  ProcessName, 

Vfl*  Virtual  Mach  I  nsNama, 

LinsActiom  String, 

ReaaonForLogof f :  Logoff Reasons) 

affact  (*>(E"NiNkcpEntry (N<: CurrentNkcps  8 

N. Process  ■  Process 
8 

EMVs VMEntry(V*iN. VMa  8 
V.VMNama  ■  VII))) 

•>  Error  <>  NoError  8 

i^’^^^^^Curr.ntNkcps  8  N.Procass  .  Process  8 
E  Vi  VMEn  try  (V<sN.  Vila  8  V.VMNaae  -  Vfl  8 
N"#Users  « 

(DastroyadVM  •> 

/fUsars  -  C"V. Users  -  i 
<>  tfUsars) 

N"#VMs  - 

(Oes<royedVN  -> 
tfVMs  -  1 
<>  Mis) 

8 

NTurrentNkcps  ■ 

(DastroyadVM  •> 

CurrentNkcps  —  SM (N)  1 1 
S"(  (N.Procass, 

N.VMs  S" (V) , 

N.AttachsdOsvices, 

N. Links)) 

<>  CurrentNkcps) 

<5 

NTendingRequesta  • 

(OeetroyedVM 

8 

~  V . 0 i sconnected  ■> 

PendingPequssts  II  S"P:PendlngRsquast  ( 
E"UiLineAddress(U<iV, Users  8 
P»(NeuMsgId, 

ClsarLine(U) , 

Undefined, 

S* ( (NetuorkProceas, 
nil, 

NoRasponse) ) ) ) ) 
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3.3.2  Authorization  Process  (Formal)  Td-6862/ 101/00 


S" ( (Neudsgld, 

(LineAction  -  ’hold'  »> 
ReOirectLine 
<>  ClearLlne), 
Undefined, 

S" ( (NetuorkProcess, 
ni  I , 

NoResponse) ) ) ) 

Pend  I ngReques ts) 


NNLines  -  Lines 


SHL»LineEntry(L<iLinea  & 

E"UtLineAddress(U<t V. Users  & 

U  •  L.Laddr)) 

I  I 

S  "LI t  L i neEn  try (E”Lt  L I neEn try (L< j L I  nee  8 

E"U:LineAddreaa(U<sV. Users  4  U  ■  L.Laddr  4 
LI  -  (L.Laddr, 

L.daxSecLevel , 

Free, 

ReEnablePending, 

L.RequestedSecLevel , 

L.AttachedVd, 

L.Connectlon, 

L.LineOropped, 

L.dRe tries, 

L .  #Aua )  t  i  ngHooks , 

L.flsg) ) ) ) 

Kerne  I  Cal  led(DeetroyVd(V.VdName) ) 

5 

(DeetroyedVfl  ■> 

(V.Di sconnected  ■> 

Kerne  I Cal led (Senddessage (OpProcesa) ) 
<>  Kerne  I Ca 1 1 ed (Senddessage (OpProcese) ) 

4 

Kerne  I Ca 1 1 ed (Senddessage ( 
NetuorkProcess) ) 

4 

KernelCai led(Senddessage( 
NetuorkProcess) ) 

4 

KernelCai led(Senddessage( 
AcntProcess) ) 

4 

A"Ui Li neAddrese(U<iV. Users  -> 
KernelCai led(Senddessage( 
NetuorkProcess) ) 

4 

Kerne  I Ca 1 1 ed (Senddessage ( 
NetuorkProcess) ) ) ) 

<>  KernelCai led (Senddessage (N. Process) ) ) ) ) ) 


-  *  *  --  «.*  a  -  - 


21  May  1978  System  Development  Corporation 

3.3.2  Authorization  Procaaa  (Formal)  Tfl-6062/1 81/08 


OPlt  Autolog 


transform  OPKUserldj  Virtue  I  hachineName, 

RequeatedSecLevel i  ProcesaName, 

Password!  String, 

AccesaPaaauord:  String) 

effect  <~(E"OiDlrectoryEntry(D<!UaerOirectory  & 

0. User Id  -  Userid 
8 

O.LogonPassword  »  Password 
8 

Oom I na  tea (□. MawSecLeve I , Requea  t edSecLev# I ) 

8 

Dam  i  na  t  as  (Reque  a  t  edSecLe  ve  I ,  D .  11 1  nSecLsva  I ) 

8 

D.IplDafined  ■  true 
8 

A" At AccessPaaswordEntry (AcjO.AccaasPasawords  8 
A.SecLevel  ■  Request edSecLeve I  -> 

A. Password  ■  AccessPassuord) ) 

8 

~  ShuttingQoun 

#Vf1s  <  WlaxVfls) 

->  Error  <>  NoError  8 
not  spscified  */  true) 
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21  May  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-6862/1B1/B0 


UR2  and  QP2:  Map  user  id 


transform  UR2 (Userid:  VlrtualflachineName, 
Requestor j  ProcsssNams) 

refcond  Requestsr  <t  S" (OpProcsss,  URProcass) 
effect  KernelCal I ed  (Sendfleasage (Requester)) 
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21  May  1978  System  Development  Corporation 

3.3.2  Authorisation  Process  (Formal)  Tfl-6062/101/00 


l y.  ...  .  .  - ,  i.,\ '  I 


0P4b<  Detach  of  shared  device  (by  operator) 


traneforn  0P4b (Raddr i  DeviceAddreee) 

refcond  E”StSharableOr iveEntry(S<iSharableOr Ives  8 

S.Raddr  -  Raddr) 

affect  E"S*SharableDr iveEntry ( 

SoSharablsOr Ives  8  S.Raddr  •  Raddr  8 
N"SharableOr Ives  -  SharableOr ivss  ~~  SMS)  II 
SM  (S.Raddr, 

/*##«/  (S. Stats  -  AttachodToSystsm 

8 

A*fltl11niOlskEntru(f1<:l1lnl0iBke  8 

fl.ContainlngVc iume  -  S.HountedVolume  -> 
M.CurrrjntLInke  »  Empty) 

8 

Devi  cel sRe leasable 
8 

□ev i caRe I  eased  •> 

Aval  table 
<>  S. State), 

S.SecLevel , 

S.  Moun  tsdVo  I  ume) ) 

8 

(S. State  *  AttachodToSystsm 
8 

A"ft:f1inlDi 8kEntry(f1<i(1lniDisko  8 

H.Conta ini ngVo Iume  »  S.flountedVolume  -> 

H.  Current!,  inks  »  Empty) 

8 

Dev  I cei sRe I easab I e 
8 

Dev  I ceRe I  eased  -> 

E" Vi SharedVo I umeEn try (V<: SharedVo I umes  8 
V.flountedOevice  -  S.HountedVolume 
8 

NMSharedVolumes  ■  SharedVo  I  umes  «<-»  SMV)  II 
S"((V. Volume, 

V.SecLevel, 

nil, 

Notllounted))} ) 
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21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TPI-S062/1 01/08 


4 

KernelCal  led (Sendflessage (OpProcess) ) 

& 

(S. State  ■  AttachedToSystem  -> 

(ATIsfli niDi skEntry  (flofliniDi  ska  4 

(1.ContainingVoli.me  •  S.hountedVolume  -> 
fl.CurrentLinka  ■  Empty)  -> 
Kerne  I Ca 1 1 ed ( I sOev i ceRe I aasab I e) 

4 

(Dev i cel sRe leasable  -> 

Kerne  I Ca 1 1 ed (Re i eaeeOev Ice))))) 


21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TM-6062/101/00 


0P4at  Detach  of  nonshared  device  (by  operator) 


transform  0P4a(Raddr»  DeviceAddress) 

refcond  E"NS:Nonsharabl eDr i veEntry (NScNonsharableDr i ves  4 

NS.Raddr  -  Raddr) 

effect  E"NS: Nonsharab I eOr i veEntry ( 

NScNonsharableDrives  4  NS.Raddr  ■  Raddr  4 
N"NonsharableOr  ives  -  Nonsharab  I  eDr  Ives  S"  (NS)  II 
S"  ((NS.Raddr, 

NS.MaxSecLevel , 

NS.flinSecLevel , 

/*##*/  (NS. State  ■  AttachedToUser  -> 

DetachPending 
<>  NS. State), 

NS. A  t  tachedPr oceas, 

NS. Access) ) 

4 

N"PendingRequests  - 

(NS. State  »  AttachedToUser  ■> 

PendingRequests  II 
S"  ( (Newflsgld, 

Re  I inqui shDevica, 

OETACH^RADOR. 

S" ( (NetuorkProcesa, 
nil, 

NoResponse) ) ) ) 

<>  PendingRequests) 

4 

(NS. State  ■  AttachedToUser  ■> 

Kerne  I  Cal  I  (Sendflessage  (NS.  At  tachedPr  ocese) ) 

<>  (NS. State  <:  S"(0ffLine,  Available)  -> 

Kerne  I  Cal  led  (Sendflessage  (OpProcase) ) ) ) ) 
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3.3.2  Authorization  Process  (Formal)  171-6062/101/00 

0P5a:  Vary  (both  online  and  offline)  of  shared  device 


transform  0P5a(Raddr:  OeviceAddress, 

Parameters  String) 

refcond  E"StSharabl eDr  I  veEntry  (SoSharableOr  ives  4 

S.Raddr  ■  Raddr) 

effect  (Parameter  ~<:  S" (’online,  ’offline’) 

->  Error  <>  NoError  4 
E "  S  s  Shar  ab I eOr 1 veEn  try ( 

ScSharableDr  i  ves  4  S.Raddr  ■  Raddr  4 
N"SharableOr ives  ■  SharableOr Ives  SMS)  II 
SM  (S.Raddr, 

/i rttitift/  (Parameter  -  ’online*  «> 

Aval  I  able 
<>  OffLine), 

S.SecLevel , 

S.MountedVolume) ) 

4 

Kerne  I  Ca  1 1  ad  (Sendflessage  (OpProcesa) ) ) ) 


21  flay  1978 

3,3,2  Authorization  Process 


System  Development  Corporation 
(Formal)  Tfl-6062/1 01/08 


OPSb*  Vary  (both  online  and  offline)  of  nonahared  device 


transform  OPSbfRaddri  DeviceAddress. 

Parameter!  String) 

refcond  E"NStNoneharableOr I veEntry (NS<jNonaharabieOr Ives  & 

NS.Raddr  •  Raddr) 

effect  (Parameter  SM’onli ne\  ’offline*) 

->  Error  <>  NoError  & 

EHNS: Nonsharab I eQr i veEntry ( 

NScNonsharabledrivee  &  NS.Raddr  -  Raddr  & 

N  c°'!8tkinrob  e0riv9a  "  Noneharab  I  eDr  I  vee  S"(NS) 

o  ( (NS# Raddr , 

NS.haxSecLavel , 

/  hh  /  NS.flinSecLevel , 

(Parameter  ■  ’online*  -> 

Ava i table 
<>  OffLlne), 

NS.AttachedProcesa, 

NS. Access) ) 

& 

Kerne  I  Ca  1 1  ed  (Sendftessage  (OpProcese) ) ) ) 
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3.3.2  Authorization  Process  (Formal)  TI1-S062/1 01/00 


OPGa:  QUERY,  with  parameters: 

DASO 

LINES 

GRAF 

ALL 

NAflES 

USERS  uith  no  further  parameter 


transform  0P6a (Command: CommandName) 
ref cond  Command* :CatGa 

effect  ICernelCal  led(Sendf1essage(0pProcess) ) 
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3.3.2  Authorization  Process  (Formal)  TH-6362/1 01/00 


QPGb:  QUERY,  with  parameters: 

raddr 

SYSTEM  raddr 


transform  0P6b (Command:  CommandName, 

Raddr:  DeviceAddrese) 

refcond  CommandcCatBb 

effect  (<v(E"S:SharableDr I veEntry (ScSharableOr ivee  8 
•  S. Raddr  ■  Raddr) 

I 

E"N5: Nonsharab I eOr I veEntry (NS<: Nonaharab I eOr I ves  & 
NS. Raddr  ■  Raddr)) 

->  Error  <>  NoError  & 

Kerne  I  Cal  led(Sendf1eaaage(0pProcase) ) ) 


21  May  1978 

3,3.2  Author i zat i on  Process 


System  Development  Corporation 
(Forma  I )  Tfl-6062/ 101/00 


0P6c>  QUERY,  uith  parameters! 

USERS  userid 
userid 


transform  0P6c (Command:  CommandNarae, 

Userid:  Virtue  I MachineName) 

refcond  CommandcCatSc 

effect  KernefCal  led(SendMessage(OpProcese) ) 
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21  May  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-B062/101/80 


0P7?  LOCATE-RAOOR 


transform  0P7(Raddrt  DeviceAddress) 

refcond  EBNS:NonsharableOr  i  veEntry  (NScNonsharableOr  Ives  8 

NS.Raddr  -  Raddr) 

effect  E"NS: Noneharab I eOr I veEntru ( 

NScNonsharableOr  Ives  8  NS.Raddr  •  Raddr  8 
N"Pendi ngRequests  « 

(NS. State  •  AttachedToUser  -> 

Pend  I ngRequests  II 
SN ( (Neuhsgld, 

OpRequsst, 

L0CATE«-RAD0R, 

/•kttU*/  S” ( (NS. At tachedProcess, 

nil, 

NoResponse) ) ) ) 

<>  Pendi ngRequests) 

(NS. State  -  AttachedToUser  -> 

Kerne  I Cal led(SendHessage(NS. At tachedProcess) ) 
<>  Kerne  I Cal led(SendHessaga(OpProcass) ) ) ) 


21  flay  1378 

3.3.2  Authorization 


System  Devs  I 
Process  (Forms  I F 


opment  Corporation 
TH-6062/101/80 


OP8»  Shutdoun 


transform  0F8 

effect  N"Shutt IngOoun  -  true 
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3.3.2  Authorization  Procaaa  (Formal)  Tfl-6062/101/00 


0P3<  Attach  (nonaharable  disk  drlva)  Device 


tranaform  0P3(Raddr:  OavIcaAddresa, 

Procasat  ProceaaName, 

VolSacLaval:  Pr ocaaaName, 

Accaaat  aat  of  Accaeaflodea) 

rofcond  E"NSiNonaharablaOr  I veEntry{NS<»NonaharableOr  Ivaa  0 

*  NS. Raddr  ■  Raddr) 

effect  E"NSi Non  ahar  ab I aOr I vaEn  tr  y  ( 

NScNonaharab  I  eDr  I  vaa  0  nS.  Raddr  -  Raddr  0 
(~(EMNiNkcpEntry (N<iCurrantNkcpa  0 
N. Procaaa  «  Procaaa 
0 

A N A: A t tachadOav I caEn try (A<iN. AttachadOav I cam  -> 
A. Raddr  «*•  Raddr) 

0 

NS.Stata  «  Fraa 
0 

Oom i nataa (N. Procaaa, Vo  I SacLave I ) 

A 

□ominatea(NS.(1axSecLavel .N.Procnaa) 

0 

□om  I  na  tea  (N.  Procaaa.  NS.  II I  nSecLeve  I ) 

OomlnataalNS.flaxSecLaval .VolSacLaval ) 

0 

□om I nataa (Vo iSecLeve I , NS. n i nSecLeve I ) ) 

0 

Accaaa  *»■  Empty 
0 

«*  Shut t  IngOoun) 

■>  Error  <>  Notrror  0 


297 


21  flay  1978  Syatem  Davalopmant  Corporation 

3.3.2  Author  I *at Ion  Procaea  (Format)  TH-G062/1 01/80 


E"NtNkcpEntry  (NcCurrantNkcpa  &  N.Procaaa  ■  Procaaa  8 
N"NoneharablaDr I vaa  -  Nonaharab I aOr i vat  S"(NS)  ft 
S"  ( (NS.Raddr, 

NS.NaxSacLaval , 

NS.fllnSacLavai , 

/*>##»>/  ( (Ur I tac  Accaaa  8  VolSacLaval  **•  N.Proceaa  •> 

/*##*/  Accaaa  S" (Ur ita)  <>  Accaaa)  Empty 

8 

GrantadAccaaa  •> 

Attachad 
<>  NS. State) . 

/'ktttti'/  ( (Ur  i  tec Accaaa  8  VolSacLaval  N.Procaaa  ■> 

/  Accaaa  S” (Ur ita)  <>  Acctiee)  Empty 

8 

GrantadAccaaa  •> 

N.Proceaa 

<>  NS.AttachedProcaaa) , 

/*##*/  (Ur ita  a  Accaaa 

8 

VolSacLaval  N.Procaaa  -> 

Accaaa  ~~  S" (Ur Ita) 

<>  Accaaa) ) ) 

8 

NHCurrentNkcps  -  CurrentNkcpa  S"  (N)  1 1 
S" ( (N.Procaaa, 

N.yna, 

/*<W*/  ( (Ur  I  tec  Accaaa  8  VolSacLaval  «•»  N.Procaaa  *> 

Av##*/  Accaaa  —  a" (Ur Ita)  <>  Accaaa)  «*-  Empty 

8 

GrantadAccaaa  ■> 

NS.AttachadOavIcaa  II 
S" ( (NS.Raddr, 

NS. Accaaa) ) 

<>  N.AttachadOavicaa) , 

N. Links)) 

8 

( (Ur  I tac Accaaa  8  VolSacLaval  N.Proceaa  ■> 

Accaaa  S" (Ur  I ta) 

<>  Accaaa) 

-  Empty  -> 

Kama  I  Ca  1 1  ad  (Sendflesaage  (OpProcaas) ) 

<>  KernelCal lad(GrantAccaaa) 

8 

(GrantadAccaaa  -> 

Kama  I  Cal  led  (Sandies  saga  (N.Proceaa) ) 

8 

Kama  I  Ca  1 1  ad  (Sandflesaage  (OpProceaa) ) 

<>  Kama  I  Cal  ledCSandflessflgatOpProcaaa))))))) 
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3.3.2  Authorization  Process  (Formal)  TTM306Z/ 101/88 


UR1  •  URProcess  request]  need  Nkcp 


transform  UR1  (RequeatedSecLevel  t  ProcessNsme, 

Raddn  OevIceAddrass) 

effect  (A"DtURPOwnedOevlceEntru(Q<]URPOunedOevices  -> 

O.Raddr  <*«  Raddr) 

->  Error  <>  NoError  & 

E"Dt  URPOwnedOev I csEn try ( 

OcURPOunedOecices  A  0. Raddr  *  Raddr  A 
N"#Nkcps  - 

(A"N:NkcpEntry(N<iCurrentNkcpe  -> 

N. Process  RequeatsdSecLavel ) 

A 

Dominates (O.MaxSecLevel .RequeatedSecLevel ) 
A 

Domlnates(RequnstadSecLavel .D.HInSecLevel ) 
A 

Mt'kcps  <  #HaxNkcps 
A 

CreatedProcess  ■> 
tfNkcps  +  1 
<>  #Nkcp«> 

A 

NMCurrentNkcps  ■ 

(A"N] NkcpEntry (N<: Curr entNkcpe  -> 

N. Process  RequeatedSecLevel) 

A 

Dam  I  nates (0. HaxSeeLeve I . Requee tedSecLave  I ) 
A 

Oominates(RequestedSecLevel  .D.fllnSecLevel ) 
A 

#Nkcps  <  /WlaxNkcpa 
A 

CreatedProcess  -> 

CurrentNkcpa  1 1 

S" ( (RequeatedSecLevel , 

Empty, 

Empty, 

Empty)) 

<>  CurrentNkcpe) 

A 


21  flag  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TM-6862/1 01/00 


(EHNsNkcpEntry  (NoCurrentNkcps  4 

N. Process  ■  RequestedSecLevsl )  ■> 

Kerne  I  Cal  led  (Sendflessage  (URProcess) ) 

<>  (Dominates (O.flaxSecLsvel .RequestedSecLevsl ) 

Dominates  (RequestedSecLevsl  .O.ftinSecLevel ) 

4 

ANkcps  <  ATIaxNkcps  ■> 

Kerne  I  Cal led(CreateProcess) 

4 

(CreatedProcess  -> 

Kerne  I Cal led  (Sendflessage  ( 
URProcess) ) 

4 

Kerne  (Called  (Sendflessage  ( 
OpProcess) ) 

4 

Kerne  I  Ca  1 1  ed  (Sendflessage  ( 
URProcesa) ) 

<>  Kerne  I  Ca  1 1  ed  (Sendflessage  ( 

URProcess) ) ) 

<>  Kerne  (Called  (Sendflessage  (URProcess) ) ) ) ) ) 


21  flay  1978  System  Development  Corporation 

3.3.2  Author i zat i on  Process  (Formal)  TM-6062/1P1/00 


UR3a:  URProcess  response  to  device  attachment  request  (attach 

succeeded) 


transform  UR3a(Raddr:  Devi ceAddress, 

Process:  ProcessName, 

Laddr:  LineAddress) 

effect  (~  (E" A: URPOunedOev i ceEntry (Ac URPOwnedOev i ces  & 

A.Raddr  ■  Raddr) 

& 

E'NsNkcpEntry  (NcCurrentNkcps  & 

N. Process  ■  Process) 

& 

E"L:LineEntry (LcLines  & 

L. Laddr  ■  Laddr 

4 

L. State  ■  AttachVa! idation 

4 

L. Cyc I ePos i t i on  «•  Hook i ngPer i phera I s 

4 

L.tfAuai t ingHooks  >0)) 

«>  Error  <>  NoError  & 

E"L:LineEntry (LcLines  &  L. Laddr  ■  Laddr  & 

N"L i neo  =  Lines  —  S" (L)  I  I 
S"  ( (L  .Laddr. 

L. HaxSecLeve I , 

L.NinSecLevel , 

L.S  tote, 

1  ft  lift  it/  (L.  //Auai  t  i  nqHooks  -  1  ■  0  -> 

Mot i fy i ngNkcp, 

<>  L.CyclePosi tion)  , 

L. RequestedSecLeve I , 

L. A  t  tachedVM, 

L. Connect i on, 

L.LineOropped, 

L.  /fRe  tr  i  es, 

/itttli-it/  L.  #Aua  i  t  i  ngHooks  -  1, 

/*//#*/  Concat  (L.Msg,  Avai  I  (Raddr) ) ) ) 

& 
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1978 

Authorization  Process 


System 

(Formal) 


Dove  I opmcn t  Corporat i on 
TM-S0S2/101/00 


NTondingRcqucsts  «• 

(L.^Auai t ingHooks  «  1  -  0 
PendingRequests  II 
S"  ( (Neullsgld, 

NewVh, 

Undef i ned, 

S"{ (Process, 

nil, 

NoResponse) ) ) ) 

s  PendingRequests) 

(L. #Aua i t i ngHooks  -  1  -  0  -> 

Ul.LineDropped  -s» 

Kerne I Ca I  led (SendMessage ( 
s  NetworkProcess))) 

ICerne  I  Ca  1 1  ed  (Sendflessage  (Process) ) ) ) ) 


21  flay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (f-ormal)  TM-G062/1 01/00 


UR3b:  URProcess  response  to  device  attachment  request  (attach 

f a i led) 


transform  UR3b(Raddr:  Dev i ceAddress, 

Process:  ProcessName, 

Laddr:  LineAddress) 

effect  (~(E"A:URPOunedOeviceEntry  (AcURPOunedDevices  & 

A. Raddr  ■  Raddr) 

4 

E"N:NkcpEntry  (NcCurrentNkcps  4 
N. Process  ■  Process) 

4 

E"L:LineEntry(L<:Lines  4 
L.Laddr  -  Laddr 
4 

L. State  ■  At tachVal i dat i on 
4 

L. Cyc I ePos i t i on  -  HookingPer ipherals 
& 

L.  #Awa i t i ngHooks  >  0)) 

■>  Error  <>  NoError  4 
E”L: L ineEn try (L<: Lines  4  L.Laddr  -  Laddr  4 
N"Lines  «  Lines  ~~  S" (L)  II 
S" ( (L.Laddr, 

L. HaxSecLeve I , 

L.fli  nSecLeve  I , 

L. S  tate, 

/•rdttt*/  (L./fAuai  tingHook9  -  1  ■  0  »> 

Not i fy i ngNkcp 
<>  L.CyclePosi t ion) , 
L.RequestedSecLevel , 

L.  A  t  tachedVfl, 

L..  Connect  i  on, 

L.LineOropped, 

L. flRetr i es, 

/*////*/  L.flAwai  t  i ngHooks  -  1, 

/*//#*/  Concat  (L.flsg.Unavai  1  (Raddr) ) ) ) 

4 


303 


System  Development  Corporation 
Author i za t ion  Process  (Formal)  TH-S0G2/181/80 


N"PendingRequests  - 

(L.tfAwai t ingliouks  -  1  »  0  ■> 
PendingRequests  I  I 

S"  ( (Neuflsgld, 

NewVfl, 

Undefined, 

S"  ( (Process, 
nil, 

NoResponse) ) ) ) 

<>  Pend i ngRequests) 

& 

(L.tfAuai t ingHooks  ■  1  -  0  -> 

(•'>(_.  LineDropped  -> 

Kerne  I  Ca  I  led  (Sendllessage  ( 
NetworkProcess) ) ) 

& 

Kerne  ICa  I  led  (Sendllessage  (Process) ) ) ) ) 


t 


21  flay  19/8  System  Development  Corporation 

3.3.2  Au thor i zat i on  Process  (Format)  TM-69S2/1 01/00 

NKCP3 j  Drop  User 


transform  NKCP3 (Process:  ProcessName. 

VM:  V  i  r  tua  Iflachi  neName, 

Laddr:  LineAddress) 

effect  (~(E"N:NkcpE''try{N<:CurrentNkcps  4 

N’.Drocess  -  Process 

«*/ 

E"V:vriEntry(V<:N.Vf1g  4 
V.VflName  ■  VM 
4 

E"UsLineAddrese(U<sV.User3  4 
U  -  Laddr))) 

4 

E"L:LinoEntry(L<:Lines  & 

L.caddr  ■  Laddr 

4 

L. State  ■  Attached 

4 

L. Connect  ion  ■  Dial 

4 

L.AttachedVfl  -  Vfl) ) 

->  Error  <>  NoError  4 
E"L:LinoEntry(L<:Lines  4  L. Laddr  -  Laddr  4 
WLincs  =  Lines  S"  (L)  II 
$"  ML. Laddr. 

L. NaxSecLeve I , 

L. M i nSecLeve I . 

/*////*/  Fro**. 

/*////*/  RrEnob  I  oPend  i  ng, 

L .  Roques  tedSecLeve  I , 

*  L. A t tachedVH, 

L. Connect i on, 

L.L i neOropped, 

L. #Retr i es, 

L. #Awai tingHooks, 

L.Msg) ) 
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21  flay  1378 

3.3.2  Authorization  Process 


System  Development  Corporation 
(Formal )  Tn-60G2/101/00 


E"N: NkcpEn try (M< jCurrentNkcps  8 
E"V: VhEntry (V<:N. Vfls4  V.VftName  - 
N"Cu'-i  ontNkcps  -  CurrentNkcps 
S" t (N. Process, 

N.VMs  ~~  S"(V)  I! 


N. Process 

vn  « 

S"(N)  II 


S"  ( (V.VflName, 

V.Laddr, 

V.Di sconnected. 

V, Users  —  S" (Laddr ) ) ) , 
N. At  tachedOevices, 

N.Li nks) ) ) ) 


4 


Process  4 


N"Pond i ngRequcsts  •  PendingRequests  II 
S"  UNeuftsgld, 

C I earL i ne, 

Undef ined, 

S" ( (Ne tuorkProcess, 

nil, 

NoResponse) ) ) ) 

4 

KernolCal  I ed (Sendflessage (Ne tuorkProcess) ) 
4 


Kerno  ICa  I  I  ed  (Sendflessage  (OpProcess) ) 
4 


KprnnICal  led  (Sendflessage  (AcntProcess) ) ) ) 
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2.3.2  Authorization  Process  IFornalf**"*  °*v* 1  °Pme^ 

NTUX3s  Link  password  received 

transform  NTWK3 (Process:  Process.,, 

Password:  String. 

Paques  tedAccess:  LinkAccesa) 
rofcona  E"LiLineEntry(L<:Lino9  i 

L.Laddr  -  Laddr 
& 

i< State  •  Attached 
& 

L.CyclePosition  .  ReaciLinkPassuord) 

effect  {^(E-N:NKcpgntry(N<:CurrentNkcp#  & 

•>  frror  <rNoErr%;  sr°CMS,) 

E"3i0^oct','ri^niru(0<'u«?nPS  4,N'Pr°casa  ■  Process  S 

£ T!NT?no'rg,|:'lLire’  4  E.LaaSr  !°l.3rV'U,'r'a  *  U**r  4 

L.rtovSecLevel , 

C.  ft  i  nSecleve  I , 

/."h  /  t. State, 

/vtfff*/  Attached, 

L.RequeatedSeclevet. 

U.  Attached  VII. 

L. Connect  ion, 

L. L i ncOropped, 

L. ^Retries, 

L.tfAuni t i ngHooke, 
u.flsgj) 
o 

<0‘p'-M^OS-nOrd^"  Pa*»«°rd  -> 

-  Hounted  -> 

phflnc  !  A^achedToSystem  -> 
a.'u«rn','^;*rcc””Co"tr”|Eia*  « 

& 


21  Hay  1978  System  Development  Corporation 

3.3.2  Authorization  Process  (Formal)  TH-S062/101/00 


(Reques tedAccess  ■  R  ■> 

(A"C; ProcessL inkEntry (CcH.CurrentL inks  -> 

Urite  *.<:  C. Access!  ■> 

L  i  nk  (N. Process, FI. MDNome.S"  (Read) ) 

<>  NoL i nk (Previ ousUr i teL i nk) ) 

<>  Reques tedAccess  -  RR  »> 

Link (N. Process, n.HQName.S"  (Read) ) 

<>  Roques tedAccess  *  U  •> 

(Urite  <:  A. Access  *> 

(fl.CurrentLinks  ■  Empty  -> 

Link  (N. Process, n.nDName.S"  (Ur  i  te) ) 

<>  NoLink(PraviousLink) ) 

<>  NoLinkINoUr! tePermission) ) 

<>  Reques tedAccess  -  UR  -> 

(Urite  <:  A. Access  ■> 

(fl.CurrentLinks  »  Empty  ■> 

Link (N. Process, n.nDName.S"  (Ur I  te)) 

<>  Link (N. Process, fl.HOName, S''  (Read) ) ) 

<>  /*  choices:  L  i  nk  (N.Process.n.fIDName.S"  (Read) ) 

NoL ink (NoUr i tePermi ssion)  >»/ 

NoL i  nk (NoUr i tePer m i ss i on) ) 

<>  RequestedAccess  ■  H  »> 

(Ur i te  <:  A. Access  »> 

(A"C:ProcessLinkEntry (C<: fl.CurrentLinks  -> 

Ur  i  t m  A./ •  P  Arraea) 

Link  (N.  Procsss,  n.fIDName.S"  (Urite) ) 

<>  NoL ink (Previ ousUr i teL ink) ) 

<>  NoL ink (NoUr i tePermission) ) 

<>  RequestedAccess  ■  1R  ■> 

(Urite  <:  A. Access  *> 

(A"C:ProcessL  inkEntry  (Cell.  Cur  rentL  inks  -> 

Urite  ~<:  C. Access)  -> 

Link  (N.Process.n.fIDName.S"  (Ur  i  te) ) 

<>  Link  (N. Procss, fl.nOName.S"  (Read) ) ) 

<>  /*  choices:  Link (N. Process, n.nDName.S"  (Read) ) 

NoL ink (NoUr i tePermission)  */ 

NoL i nk (NoUr i tePermi ssion)) 

<>  RequestedAccess  »  HU  ■> 

(Urite  <:  A. Access  ■> 

Link  (N. Process, n.nDName.S" (Urite)) 

<>  NoL ink (NoUr i tePermi ssion) ))))))))))))) 
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transform  L i nk (Process:  ProcessName, 

MiniOisk:  M i n i 0 i skName, 

Across: set  of  AccessModes) 

effect  E"N:NkcpEntru  (NcCurrentNkcps  4  N. Process  ■  Process  4 

E"M: M i n i 0 i skEn try (M<: Mi n iOi sks  4  M.MOName  ■  MiniDisk  4 
(E"MPL : Pr ocessL I nkEn try ( 

MPLoM.CurrentUnks  4  MPL. Process  *  N. Process)  •> 
E"nPL:ProcessLinkEntry ( 

MPLcM.CurrentLinks  &  MPL. Process  -  N. Process  4 
E"Nf1L:f10L  i  nkEn  try  (NMLcN.L  inks  4  NML.MOName  -  M.MOName  4 
(Access  *«<•  MPL. Access  -> 

kernelCal I ed (GrantAccess) 

4 

(GrantedAccess  ■> 

N"CurrentMkcps  •  CurrentNkos  ~~  S"  (N)  II 
S"  ( (N. Process, 

N.VMs. 

N. A  t  tachedDev i ces, 

N. Links  S" (NML!  II 
S"( (NML.MOName. 

Access) ) ) ) 

4 

N"Mini0i3ks  -  MiniOisks  ~~  S"  (M)  II 
S" ((M.MOName, 

M. Con  ta I n i ngVo I ume, 

M.Cyl inders, 

M.SecLevel. 

M.CurrentL i nks  ~~  S" (MPL)  II 
S'1  ( (MDL. Process, 

Access) ) , 

M.AccessContro ILi st) ) 

<>  N"CurrentNkops  -  Curi~entNkcps 
4 

N"Mini0isk9  ■  MiniDi sks! ) ' ) 

<>  kerne iCa I  I ed (GrantAccess) 

4 
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(Gran tedAcceos  »> 

TCurrentNkcps  ■  CurrentNkcps  ~~  S"  (N)  II 
S" ( (N. Process, 

N.VMs, 

N.AttachedOevices, 

N. Links  II 
S"  ( (d.dONamc, 

Access) ) i ) 

8 

N"f1iniDisks  ■  diniDisks  ^  S"  (d)  II 
S"  Ud.nOName, 

II.  Con  t  a  i  n  i  ngVo  I  ume, 

M.Cy I inders, 
fl.  SecLeve  I , 
fl.CurrentLInks  I  I 
S"  ( (N.Proceo3, 

Accoso) ) , 

d.AccessControlLi  st) ) 

<>  N"CurrentNkcps  -  CurrentNkcps 
& 

N"diniOisks  •  diniDisks)))) 


21  flay  19 78  Cl  n 
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m-60S2/l  01/80 


NKCP4:  Link  (with  possuord) 


transform  NKCP4 (Process}  ProcessName, 

P.v,uo3 1 or :  V  i  r  t ua  I  flach  i  neName , 

Laddr;  LineAddress, 

Usrr:  Virtual  Mach i neName, 

NmiDiskt  ftiniOi skName, 
nec|U03 teciAccess:  LinkAccess) 

effect  (Shutt  inqOoun 

t 

RcqueotedAccess  ■  Empty 
»>  Error  <>  NoError  & 

<E"N:NkcpEntry  (No.CurrentNkcps  & 

N. Process  «  Process 
& 

E"E;  .'riEntrytEcN.Vtts  4 

&  E.VflName  ■  Requester)) 

E ’’L: LineEn try (L<s Lines  & 

L.Laddr  •  Laddr 
& 

L. State  -  Attached 
<S 

L.CyclePosition  *  Attached 
<5 

L . Request edSecLeve I  -  Process 
L. A t tachedVfl  »  Requester) 

*> 

E"0.*D  i  rec  toryEn  try  (DcUserDi  rectory  & 

0. Userid  •  User 
& 

E"K:f1DLinkEntry{K<:D. Links  <5 
K.flOName  -  MiniOisk)) 

<> 

E  N:f1ini0i  skEntry(f1<:Mini0isks  4 

tt.tlONj me  ■  NiniOisk 
<S 

E"A: ACLEntry (Acfl. AccessContro IL i  s t  & 

A. user  -  Requester 
& 

Oom  i  nates  (Process,  ft.  SecLeve  I ) 

0» 

(Ur  i  te«?:Reques tedAccess  -> 

Process  ■  ft. SecLeve)) ) 
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E"Vi  ShareclVo  lumeEn  try  (VoSharedVo  lumes  & 

V. Volume  ■  M.ContainingVolume 
8 

V. State  ■  Mounted 

8 

E"S:Sharab!eDr  I  veEntry  (SoSharableDr  Ives  8 
S.Raddr  -  V.MountedDevlce 

8 

S. State  -  AttachedToSystem) ) )  »> 

Kerne  I Ca I  I ed (SendMessage (NetuorkProcesa) ) 

8 

KernelCal I ed (SendMessage (NetuorkProcesa) ) 

8 

E"L:L  inoEntry  (LcLines  8  L.Laddr  ■  Laddr  8 
N"Lino3  ■  Lines  ***»  S"(L)  II 
S" ( (L.Laddr. 

L.MaxSecLevel , 

L. M i nSecLeve  I , 

L. State, 

L.CiicloPosi  tion, 

L. Roques tcdSecLeve I , 

L. AttachodVM, 

L. Connect  ion, 

L.LinoQropped, 

L.tfRetr ies, 

L .  7/Ai-ia  i  tingHooks, 

L.Msg) ) ) 

8 

N"Pcnd i ngRequests  •  PendingRequests  II 
S" ( (NeuMsgld, 

Uri teAndReadLine, 

Undef ined, 

S" ( (NetuorkProcess, 
nil, 

NoResponse) ) ) ) 

<>  N"Lines  -  Lines 
8 

N"PendingRequests  -  PendingRequests 
8 

KernelCal I ed (SendMessage (Process) ) ) ) 
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NKCP5,  NKCPG:  Ootach  nonsharable  device  (request  from  process), 
and  response  (from  process)  to  relinquish  device  requeet  from 
Authprocess 


transform  NKCP5 (Raddr ;  Dev i ceAddress, 

Process:  ProcessName, 

User:  VirtualflachineName) 

(~  (E"N:NkcpEntry  (NcCurrentNkcps  A 
N. Process  ■  Process 
A 

E"VM:  VflEntry  (VflcN.  VMs  A 
Vfl.VfiName  *  User) 

A 

E"A:  AttachedOevIceEntry  (AoN.  AttachedOevicee  A 
A. Raddr  ■  Raddr)) 

& 

E"NS: Nonsharab I eOr i veEntry (NSc Nonsharab I eOr i  ves  4 
MS. Raddr  -  Raddr 
A 

NS. At tachedProcess  -  Process; ) 

■>  Error  <>  NoError  A 

E "NS : Nonsharab I eOr i veEntry,  NrNkcpEntry ( 

NS<: Nonsharab I eOr i vee  A  NS. Raddr  »  Raddr  A 
NcCurrentNkcps  A  N. Process  »  Process  A 
N"NonsharableOr ; ves  -  Nonsharab I eDr i ves  ~~  S" (NS)  II 
S"( (NS. Raddr, 

NS.flaxSecLeve I , 

NS.ninSecLevel , 

(Devi ceRe I  eased  -> 

Aval I  able 
<>  NS, State), 

NS. A  t tachedProcess, 

MS. Access)) 

A 

N"CurrentNkcps  ■  CurrentNkcps  S"  (N)  II 
S"  (  (N. Process, 

N.VMs, 

(Dev i ceRe i eased  ■> 

N.AttachedOevices  ~ 

S"A: At tachedDeviceEntry ( 

Ac N.AttachedOevices 
A 

A. Raddr  ■  NS. Raddr) 

<>  N.AttachedOevices), 

N.L i nks) ) 
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3 

KernelCal led(RelsaseQevice(NS.Raddr) ) 

& 

Kerne ICa I  I ed (SendMessage (QpProcess) ) 

& 

(Dev i crRo I  eased  ■> 

KernelCal I ed (SendMessage (AcntProcess' ) 

<>  KernelCal I ed (SendMessage (NS.AttachedProcese) ) ) ) ) 
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NKCP7:  Purge  NKCP 


transform  NKCP7 (Process:  ProcessName) 

effect  (~(E"N:NkcpEntry (N<: CurrentNkcps  & 

N. Process  ■  Process 
& 

N.VMs  ■  Empty 
& 

N. A t tachedOev i ces  -  Empty 
& 

N. Links  -  Empty) ) 

->  Error  <>  NoError  & 

E"N:NkcpEntry (N<: CurrentNkcps  &  N. Process  ■  Process  & 
N"CurrertNkcps  ■  CurrentNkcps  ~~  S" (N) ) ) 
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KERN1:  message  from  Kernel,  re  shared  device  availability 


transform  KERN1  (RadcJr:  Dev i ceAddress, 

Volumes  Volumeid, 

Currents ta tus:  Sharabl eDr i veSta tus) 

effect  (~ (E"S: Sharab I eDr  i  veEntry  (ScSharableDrives  & 

S.Raddr  ■  Raddr 
4 

(CurrentStatus  -  At tachedToSystem  -> 

E" V: SharedVo I umeEntry (V<: SharedVo I umee  4 
V, Volume  ■  Volume) ) ) ) 

«>  Error  <>  NoError  4 

E"S:Sharab  I  eDr  i  veEn  try  (ScSharabl  eDr  i  ves  4  S.Raddr  -  Raddr  & 

(S. State  »  At  tachedToSystem  ••> 

(CurrentStatus  ■  At tachedToSystem  ■> 

(Volume  -v-  S. MountedVo I ume  ■> 

(E"MjMiniDiskEntry  (McMiniDisks  4 

M.ContainingVolume  ■  S. MountedVo I ume 
& 

M.CurrentLinks  <«-  Empty)  -> 

Error 

<>  E" Vo  I  d, Vneu: SharedVo I umeEn  try ( 

Vo  I d<: SharedVo I umes  4  VnewcSharedVoiumes  & 

Void. Volume  -  S. MountedVo I ume 
4 

Void. State  »  Mounted 
4 

Vold.MountedDevice  -  S.Raddr 
& 

Vnew.Volume  *  Volume 
4 

(Dominates(S.SecLevei , VneuSecLevel )  ■> 

N"Sharab I eDr i ves  *  Sharab  I  eDr  i  ves  S"  (S)  II 
S"  ((S.Raddr, 

S. State, 

S.SecLevel , 

Vneu. Volume) ) 

4 

N"SharedVo I umes  -  SharedVo I umes 
~~  S" (Vo  I d, Vneu) 

I  I 

S”(  (Vo Id. Vo! ume, 

Vo  I d.SecLeve I , 
nil, 

NotMounted) ) 

I  I 

S"  ( (Vneu. Volume. 

Vneu. SecLeve I , 

S.Raddr, 

Mounted) ) 

4 
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<> 


Kerne  I Ca I  I ed (Dr i veMatchesVo I ume) 

<>  N"SharableDrives  «  SharableDrives 
£ 

N"SharedVoiumes  »  SharedVolumes 
£ 

Kerne  I  Cal  I  ed  (Dr  i  veOoesNotMatchVo  I  ume) ) ) ) 
<>  N"Sharab I eDr i ve3  ■  SharableDrives 

<S 

N"SharedVol umes  ■  SharedVolumes 
& 

Kerne  I Ca I  I ed (Dr i veMatchesVo I ume) ) 

<>  E"V: SharedVo I umeEntry (V<: SharedVo I umes  & 

V. Vo  I ume  -  S.MountedVo I ume 
£ 

V. State  *  Mounted 
£ 

v.MountedDevice  ■  S.Raddr 

N"Sharab I eDr i ves  -  SharableDrives  ~~  S"  (S)  II 
S" ( (S.Raddr. 

CurrentStatus, 

S. SecLevel , 
nil)) 


£ 

N"SharedVolumes  ■  SharedVolumes  S"(V)  II 
S" ((V. Volume. 

V. SecLevel , 
nil, 

NotMounted) ) ) ) 

(CurrentStatus  *  At tachedToSystem  -> 

E"V: SharedVo I umeEntry (V<: SharedVo I umes  4 
V. Vo  I ume  -  Volume 
£ 

(Dominates (S. Secleve I , V. SecLeve I )  -> 

N"SharableOr ives  -  Sharab I eDr i ves  ~~  S" (S)  II 
S"( (S.Raddr, 

At  tachedToSystem, 

S. SecLeve I , 

V, Volume) ) 

£ 

N"SharedVolumes  ■  SharedVolumes  ~~  S" (V)  II 
S" ( (V. Vo lume, 

V, SecLeve I , 

S.Raddr, 

Mounted) ) 


£ 

Kerne  I  Cal  led (Dr i veMatchesVo I ume) 
<>  N"SharableDr  i ves  ■  SharableDrives 
£ 


N"SharedVo I umes  •  SharedVo I umes 
£ 

Kerne  I Ca I  led (Dr i veDoesNotMatchVo I ume) ) ) 


217 


21  flay  1973  System  Development  Corporation 

3.3.2'  Authorization  Process  (Formal)  Tfl-6062/101/00 


\ 


transform  MscjOp  (Mscjl d:  Hessageld, 

T.*-.t:  String, 

Source:  ProcessName) 

refcond  Source  -  OpProcess 

effect  (f "P : Pend i nciReques  t (P<: Pendi ngRaques  t s 

4 

P.flsgld  -  Hsgld)  ■> 

Error 

<>  (HisrjName  ( Text)  -  AUTOLOG  »> 

0P1 

<>  HsgName (Text)  -  ATTACH^ADOR  -> 

(E"NS:  NonsharableOr iveEntry(NS<:NonsharableOrivee  A 
NS.Raddr  -  Raddr(Text))  ■> 

0P3 

<>  Error) 

<>  HsgName (Text)  ■  DETACH*  r.ADDR  ■> 

(E"NS:  NonsharableOr  i  veEntry  (NScNonsharab I eDrivee  & 
NS.Raddr  ■  Raddr(Text))  ■> 

0P4a 

<>  E"S:  SharableOr i veEntry (ScSharab I eDrives  4 
S.Raddr  ■  Raddr(Text))  ■> 

IJP4b 

<>  M snNnme'f  Tex t )  < : S "  ( VARY*-0NL I NE .  VARY«-OFFLINE)  -> 

(E"NS:  NonsharableOr  i  veEntry  (NScNonsharab  I  eDr  i  ves  4 
NS.Raddr  ■  RaddrtText))  *» 

OPSb 

<>  E"S:  SharableOriveEntry(S<:SharableDri ves  4 
S.Raddr  -  Raddr(Text))  -> 

GFSa 

<>  Error) 

<>  ftsqName (Text) cCatGa  ■> 

OPGa 

<>  HsgNamc (Text)  cCatSb 
OPGb 

<>  HsgNamc (Text) <:Cat6c  ■> 

OPGc 

<>  flsgNamc (Text)  ■  LGCATE*RADOR  ■> 

0P7a 

<>  HsgNamc  (Text)  «  SHUTOOUN  ■> 

GPS 

<>  HsgNamc  (Text)  ■  HapUserld  ■> 

0P2 

<>  Error ) ) 
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transform  tlsgUR (M sej  1  d:  dessageld. 

Text:  String, 

Source:  ProcessName) 

refcond  Source  «  URProcoss 

effect  (E"P:PendingRcquest  (PcPendingRequests  4 
P.Mogld  ”  flogld)  ■> 

E"P:PondinqRequest  (PcPendingRequests  & 

P.Msgld  «  Msg  Id 

& 

(P.Kind  »  Attach  ■>  * 

(flonNnme  (Text)  ■  Attached  »> 

UR3.1 

<>  flsuName  (Text )  <: S"  (At  tachFa i  I ed.Dev iceNotAval  I ab I e) 

UR3b 

<>  Error) 

<>  Error)) 

<>  (flsgName (Text)  *  NeedNkcp  ■> 

URL 

<>  MsrjNnme  (Text)  ■  flapUserld  ■> 

UR.? 

<>  Error ) ) 


■  n  n-  System  Development  Corporation 

Authorization  Process  (Formal)  Tfl-6062/1 01/00 


transform  MsciNet  (Msgld;  (lassac/eH, 

String, 

1  "irco:  Proco3sName) 
refcond  Source  -  No tuorkProcess 
effect  <E"P:  Fend  incjnpquest  (PcPendingRequests  & 

P.th'jtd  -  Mr.rjf di  -> 

CPiPondingRequest  (P<!PendingRequests  S 

P. rtsiji cl  ■  flsgf d 
<S 

(P.Kiivk.S"  (C'eartine,  ReDirectLine) 

(risr//ame (Text)  »  LineStatus  -> 

NTUKl 
<>  Error) 

<>  P.<ind  •  Ur i teAndReadL ine  ■> 

(flsyNcJitie  ( Tex t )  •  Linefnfo  *> 

(E"L: L i neEntry (L<:L  i nes  & 

L.Laddr  -  Laddr(lext))  -> 

E"L: Li neEntry (L<: Li nes  & 

L.Laddr  -  Ladclr(Text) 

<S 

(L. State  ■  Attached  »> 

^*NTW)<3^0S  * 1 '  °n  "  ^eacJl-'nkPassw°rd  »> 

Error) 

<>  L. State  .  AttachVal idation 
(L.  Cyc I  ePos  i  t  i  on  »  Retru  •>> 

LGDL2  y 

<>  i-’^ypIcPosi  t  ion  -  Readlni  t  i  alPassworc 
LG0L3 
& 

(TENP"L.Cye lePos i t ion  ■ 

Per formResourceChecka  - 

(LG0L5 
& 

(TEMP”l .CyclePosi  t  ion  » 
AttachOevicea  -> 

(LGOLS 
& 

LGDL7) ) ) ) 


m> 


321 


21  May  13/8  -  _ 

3.3.2  Authorization  Procoss  "  8Vel0pme^_^P°[|1t;|J 


<>  L. Cyc I oPos i t i on  « 

i  -r>1R?aciAcca9»pa99word  -> 

LUULA 

& 

(TEMP"L.CyclePosi t ion  - 

(LGDLS  Perfor,nR®sourceChecks 
& 

(TEMP  L. Cyc I ePos i t i on  ■ 

(LGOLs"aChD”'iCM  '* 

<S 

_  LGDL7) ) ) ) 

<>  Error) 

<>  Error)) 

<>  Error) 

°  ^ro><t,  “  LineStatU9  -> 

<>  Error) 

<>  Error) ) 

<;>  ^r1otJNNruk‘iTe><t,  “  LinaStatu®  -> 

<>  MagNametText)  -  Lin.Info  -> 

LbUL  1 
<>  Error) ) 


322 


A 


1 


> 


21  May  1978 

3.3.2  Authorisation  Process 


System  Development  Corporation 
(Forma  I >  TM-G0G2/1 01/00 


transform  MsgNkcpUJoqld:  Messageld, 

*c-  a  t :  String, 

Source:  Proce3sName) 

refcond  Source  ~<:  TruntedProcesses I INetuorkProcess 

effect  (E”P: Pend tnrjRpquoat (PcPendihgRcquesta  & 

P. Msg  Id  *  flsgld)  -> 

E"P: Pond i ngReques t (Pc  Pendi  ngRequests  & 

P.MsglcI  «  Msgld 

& 

(P.Kind  »  OqRequest  ■> 

(MsciNanie  ( Tex  t )  ■  RespcnseToQpRequest  ■> 
ProcessedResponsetP,  Text,  Source) 

<>  Error) 

<:>  '  (NeuVM, Connect VM.NeuUser  , NeuQrConneetedVM)  ■> 

(E  L:L i neEn try (L<: Lines  & 

L.Laddr  ■  Laddr(Text))  *> 

LGDLG 
<>  Error) 

<>  P.Kind  -  Re  I i nqui shOev i ce  -> 

(MsciNanie  ■  DetachOevice  ■> 

MKCPG 
<>  Error) 

<>  Error ) ) 

<>  (MscjNnme ( Text)  -  Disconnect  -> 

NKCP1 

<>  MsyName (Text)  -  Logoff  »> 

NKCP2 

<>  MsgName (Text)  «  OropUser  -> 

NKCP3 

<>  MsriNJame  (Text)  ■  Link  ■> 

NKCP4 

■<>  MsyName (Text)  ■  OetachOevice  *> 

NKCPS 

<>  MsgName (Text)  -  PurgeNkcp  *> 

NKCP7 
<>  Error) ) 


i 
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System  Development  Corporation 
(Formal )  111-6062/101/00 


transform  AuthOr ivcr  f I nterruptTypes  ?, 

I nterruptSubTypes  ?, 

Msrjlds  Messageld, 

Texts  String, 

Sources  ProcessName) 

effect  (InttrruptTupe  -  External  Interrupt  «> 

(In  errup tSubType  »  Message  »> 

Messacjeflece  i  ved 
& 

,  (Source  -  OpProcess  »> 

MsgOp  (Msgltd,  Text,  Source) 

<>  Source  ■  URProcess  ■> 

MsgUR (Msg I d.  Text,  3ource) 

<>  Source  ■  Ne tuorkProcess  •> 

MggNet (Msgld,  Text.  Source) 

<>  Source  ~<s  TeustedProcesses I INetuorkProcess  -> 
MsgNkcp (Msgld,  Text,  Source) 
oError ) 

<’.*  Error) 

<>  Error) 

& 

KernelCal I ed  (Rece i velnterrupts) 

& 

Kerne iCa I  I ed  (Re  I easeCPU) 
end  AuthProce9S 
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3.4.1  Accounting  Process  (Informal)  TM-6062/101/00 


3.4.1:  Accounting  Process 
Informal  Description 

This  section  contains  the  informal  description  of  the  Accounting 
Procsss  of  KVN/378. 


Overv i eu 


The  Trusted  Process  performing  the  accounting  function, 
ACNTProcess,  is  one  of  the  simpler  processes.  It  accepts  tuo 
flavors  of  accounting  records  from  NKCPs,  and  saves  them  in  a  data 
base.  it  also  accepts  tuo  operator  commands  that  cause  the  old 
data  base  to  be  saved  and  a  neu  empty  one  to  be  created. 

The  only  complexity  is  the  need  for  preserving  the  A-property  when 
tallying  the  computer  usage  accounts.  Each  user  is  presented  uith 
a  bill  uhich  contains  no  information  derived  from  other  users’ 
accounting  information.  To  accomplish  this,  the  Accounting 
Process  keeps  its  accounting  records  keyed  on  user  id. 

The  formal  specification  also  glosses  over  an  important  effect  of 
the  operator's  commands.  In  "0P1",  the  "effect"  section  says 
nothing  about  actually  saving  the  old  data  base,  presumably  as  a 
spool  file  intended  for  the  card  punch. 
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3.4.1  Accounting  Process  (Informal)  TM-S062/101/80 


NKCP  Communication  uith  the  Accounting  Process 

There  are  two  kinds  of  message  that  an  NKCP  can  send  to  the 
Accounting  Process.  Their  respective  labels  are: 

-  DeviceUse;  and 

-  SystemResourceUse. 

The  first.  DeviceUse.  is  indirectly  sent  to  the  Accounting  Process 
by  an  NKCP  whenever  a  device  is  detached  from  a  VM.  The 
accounting  record  describes  the  utilization  of%the  device  by  the 
VM.  The  message  comes  to  the  Accounting  Process  via  the 
Authorization  Process. 

The  second  messacie  type,  SystemResourceUse,  is  also  indirectly 
sent  to  the  Accounting  Process  by  an  NKCP  via  the  Authorization 
Process.  When  a  VM  1099  off  (or  is  forced  off,  etc.),  the 
controlling  NKCP  notifies  the  Authorization  Process  so  that  system 
tables  may  be  updated  and  communication  lines  freed.  As  part  of 
this  message,  the  NKCP  includes  accounting  information  that  the 
Authorization  Process  reflects  to  the  Accounting  F.-ocess. 

The  design  purposely  incorporates  this  roundabout  form  of  message 
passing  so  that  the  user  id  (VM  name)  reported  in  the  accounting 
record  may  be  verified  to  actually  exist  as  a  VM  controlled  by  the 
requesting  NKCP. 
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Communication  between  the  Operator-  and  the  Accounting  Process 

There  are  two  operator  commands  which  affect  the  Accounting 
Process: 

-  ACNT ;  and 

-  SHUTDOWN. 

The  operator  command  ACNT  has  the  following  perm i stable 
parameters: 

-  U'U'r  id; 

ALL;  and 

-  PUNCH. 

The  first  two  are  present  in  VM/370;  the  last  is  new  in  KVM.  The 
first  two  cause  one  or  more  NKCPs  to  generate  accounting  records 
for  users.  These  accounting  records  are  sent  as  messages  to  the 
Authorization  Proems,  which  verifies  that  the  user  ids  are  indeed 
logged  on  and  being  controlled  by  the  reporting  NKCP.  The 
Authorization  Process  then  sends  the  messages  on  to  the  Accounting 
Process  for  recording. 

The  operator  commands  ACNT*-PUNCH  and  SHUTDOWN  are  reflected  by  the 
Operator  Process  directly  to  the  Accounting  Process.  The  commands 
cause  the  current  data  oase  of  accounting  records  to  be  saved  and 
a  neu  empty  one  to  be  started.  Both  have  the  same  effect. 
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3.4.2:  Accounting  Process 
Formal  Speci f icat ion 


module  AcntProcess 
type 

MessageLabe  I  s  ■  (SystemResourceUse,OeviceUse,ACNTVPUNCH,SHUTDOUN) , 
Kerne IFunct i on  ■  (SendMessage) , 

constant 

AuthProcess, OpProcess:  ProcessName, 

Error:  boolean, 

SendMessage (ProcessName) :  Kerne  I  Function 
transform  KernelCal !ed(K:KernelFunction) 
effect  true 

/it  Parameter  Functions  */ 
constant 

MsgName (Str i ng) :  MessageLabe I s. 

User (String) :  Virtual  Mach ineName, 

NeuPost ing(String) :  String 
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(Formal J 


type 
Char , 

f  <r  incj  -  list  of  Char, 
v irtualMachineName. 

ProcessName, 
flessagel  d, 

Accoun t i ngRecord  =  structure  of( 

User  =  V  j  r  tua  I  flach  i  neName, 
Postings  »  set  of  String) 

var i ab I e 

Accounting:  set  of  Account i ngRecord 
initial 

Accounting  ■  Empty 


invar  iant 

A' Al,  A2 j  Accoun  t  i  lgRecor d  (Ale  Accoun 1 1  no 

&  J 

...  ..  ,  A2<: Account i ng 

(AJ . User  -  A2. User  ->  Al  .  A2) ) 


-> 
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Subdriver  of  Acn tProcoss, 

honcK  irv  messages  from  Au*hProces9 

transform  MagAuth (Msrjl d:  Messagelcl, 

String, 

Source:  ProceesName) 
refcond  Source  -  AuthProcess 


errect  (nsgNatne  (Text )  <:S' 


<> 


AIITU ,  ?ys  1  emnesour ceuse , Dev i ceUse) 
AUTIil  (User  (Tex  il  .NeuPost  inn  (Text) ) 
Error)  J 
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Subdriver  of  AcntProcoss, 

handling  messages  from  QpProcass 

transform  flsgOp (Mscil ds  Messageld, 

Tent:  String, 

Source:  ProcessName) 


refcond  Source  »  OpProcess 

effect  (MsgName  (Text)  <:S"  (ACNT«-PUNCH,  SHUTDOWN)  -> 
DPI 

<>  Error) 
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AUTH1:  Accounting  record  from  Nkcp  via  Authorization  Process: 

System  Resource  Use  or  Device  Use 

transform  AUTHi (User:  V i r tua IMachi neName, 

NeuPostingj  String) 

refcond  true  Av  user  id  has  boen  validated  by  AuthProcess 

prior  to  the  sending  of  this  message  */ 

effect  E"A: Account i ngRecord (Ac Account i ng  -> 

(A. User  ■  User 
S 

NewPostingcA.Post  ings) ) 
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0P1 :  Operator  command  to  re- i n i t i a  I i ze  the  accounting  data  base 
transform  0P1 

effect  N"Accounting  =.  Empty 
& 

Kerne  I Ca I  I cd (Scndneosage (OpProcess) ) 
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transform  AcntDr  i  vor  ( I n torrupt  Type: 

! n fnrruptSubfype: 

flsyld:  lleosageld, 

Text:  String, 

Source:  ProcessName) 

effect  ( I  nterrup tType  ■  External  Interrupt  *> 
UnturruptSubType  -  Hessage  -> 

(Source  ■  OpProcess  ■> 

MsyOp (flsctl d.  Text, Source) 

*  <>  Source  ■  AuthProcess  »> 

MsgAuth (Msg! d. Text, Source) 

<>  Error) 

<>  Error) 

<>  Error) 
end  AcntProcess 
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3.0.1;  Updater  Process 

Informal  Description 


This  section  contains  the 
Process  of  KVM/370. 


informal  description  of  the  Updater 


Overview 


The  Updater  creates  and  updates 
collectively  known  as  the  D 
information  about  system  users, 
owned  volumes. 


the  set 
i rectory . 
devices. 


of  databases  which  are 
The  Directory  contains 
terminals,  and  system- 


Each  user  id  must 
the  user  id  i s  a 
capabi  I i ties  as  w ell 
user  may  be  attached. 


?lthm  the  system.  Associated  with 
clearance  (maximum  security-level)  and  a  list  of 
as  notes  for  the  use  of  any  NKCP  to  which  the 


Each  real 
wh i ch  is 
dev i ce. 


device  and  terminal 
the  maximum  level  of 


is  associated  with  a  secur i ty- level 
information  that  may  appear  on  that 
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THE  UPDATER  REQUESTS 

The  System  Security  Officer  or  other  user  of  the  Updater  may  make 
the  following  type3  of  requests: 


1.  Add,  change  or  delete  a  user. 

The  following  are  associated  with  each  user: 

-  user  id  (must  be  unique) 

-  password 

-  clearance 

-  objects  (a  list  of  (object-name,  access-type!)  uhere 
object-nanie  may  name  a  minidisk  or  a  real  device. 

-  notes  for  use  by  NKCP 

-  privilege  clasoos  (zero  or  more  of  A..H) 

-  maximum  and  default  storage  sizes 

-  virtual  devices  (a  list  of  tvaddr,  devtype, 
corresponding  real  deviceJ)  (if  any) 

-  initial  scheduling  priority 

-  initial  line  editing  characters 

-  accounting  information  and  output  distribution  code 

-  options  (zero  or  more  of  (ECMODE,  REALT1MER,  ACCT, 
SVCOFF.  BMK) ) 

-  auto  IPL  system,  if  any 


When  a  ncu  user  is  added  to  the  directory,  all  the  fields  must  be 
specified,  though  some  may  be  defaulted  to  null  (objects, 
privileges,  virtual  devices  and  options)  or  to  standard  values 
(priority  ■  5R,  lino-  edit  •  EON, ' ®’ .  The  user  id 
must  be  distinct  from  any  user  id  presently  i1  the  directory. 


Uhen  updating  a  user  entry,  any  of  the  above  fields  may  be 
changed.  If  the  user  id  is  changed,  the  new  value  must  not  be  the 
same  as  any  other  user  id  in  the  directory.  The  following  are 
recognized  as  special  cases: 

(a)  add  or  delete  a  category  in  clearance 

(b)  add  or  delete  an  object 

(c)  add  or  delete  a  privilege  to  the  privilege  classes 

(d)  add,  delete  or  change  a  virtual  device. 

(r)  the  options  are  not  treated  as  a  list.  Rather,  each 
is  handled  as  a  separate  boolean. 


Each  real  device  mentioned  in  the  virtual  device  Ms 
corresponding  real  device  mentioned  in  the  links 
section.  Each  real  device  and  link  should  have  a 
entry  in  the  virtual  devices,  though  a  failure  to  do 
arror  and  the  entry  may  be  stored  after  confirmation 
Security  Officer  (SSO) . 


t  must  have  a 
or  dedicates 
corresponding 
so  is  not  an 
by  the  System 
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2.  Update  the  security  lattice 

Add  a  spec i a  I -access  compartment 

3.  Create,  change  and  delete  devices  and  terminals  (lines). 

Each  device  has  the  following  associated  with  it: 

-  Device  address  and  type 

-  clearance  (maximum  security  level) 

-  minimum  security  level,  if  any 

-  flogs: 

-  trusted/untrusted  device 

system-owned  (i.e.  owned  volumes  and  only 
owned  volumes  may  be  mounted). 

A.  Create,  format  and  allocate  real  System  Owned  Volumes 

a.  Define  volume 

-  volume  serial  number  (must  be  unique) 

-  maximum  secur i ty- 1  eve  I 

b.  Label  volume  (volume  must  be  mounted  and  attached  to  UpdiVer) 

-  vo I ume  ser i a  I  number 

-  real  device 

sec- I  eve  I (dev i ce)  must  dominate  sec-level (volume)  existing 
volume  label  (if  any)  (cyl  0,  track  0.  record  3)  is  typed  out  for 
SSO  who  must  confirm  that  he  wants  to  format  the  volume. 

A  label  and  blank  allocation  record  (all  cylinders  except  0 
available)  are  written  on  the  volume,  which  is  then  detached  from 
the  Updater  and  attached  to  "SYSTEM". 


21  May  19/8  System  Development  Corporation 

3.5.1  Updater  Process  (Informal)  TM-6062/101/00 


THE  FOLLOWING  REQUIRE  THE  VOLUME  BE  MOUNTED  AND  ATTACHED  TO  "SYSTEM" 

c.  Delete  volume.  The  volume  is  deleted  from  the  owned  volume 
list.  All  cylinders  marked  as  classified  have  home 
addresses  written  on  each  track  (which  clears  the  rest  of 
the  track)  and  are  marked  available. 


d.  All ocate  space 

-  type  of  space: 

(Global  areas  -  security  level  need  not  be  specified  - 
always  system-high  -  volume  must  be  system-high) 

PAGE  (suballocated  by  DASD  page  allocator) 

SPOOL  (cylinders  suballocated  by  Spool  File  Memory, 
records  by  NKCPs) 

0 i rectory 
I  PL  circa 

(areas  used  by  NKCPs  -  security  level  must  be  specified) 

WarmStart  or  checkpoint  area 
Shared  segment  area 

-  name  of  segment  (must  be  unique) 

Temporary  Disk  Space  (suballocatd  by  NKCP) 

Minidisks 

-  name  (must  be  unique) 

-  passwords  or  ACLs 

(ACLs  are  array  by  accesstype  of  [user  id!) 

-  secur i ty- I  eve  I  (except  global  areas  uhich  are  always  system 

high.  The  security  level  of  an  area  must  be 
dominated  by  the  clearance  of  the  volume.) 

-  starting  cy I i nder 

-  number  of  cylinders 

The  requested  area  must  not  overlap  any  area  currently  allocated 
on  the  volume.  Thus,  to  increase  the  size  of  an  area,  the  area 
must  be  deleted  and  then  re-allocated  in  the  increased  area. 

When  a  shared  segment  area  or  Minidisk  is  created,  the  name  must 
be  different  from  any  other  object  of  the  same  kind  in  the  system. 

If  passwords  are  used,  3  passwords  are  provided  for  each  minidisk: 
[read  password,  write  password,  9imul taneous-wr  i  te  password]. 

If  ACLs  are  used,  the  following  functions  are  to  be  provided: 

-  Create  a  "group"  ACL 

-  Add  or  delete  a  user  id  to  an  ACL 

-  Add  or  delete  an  ACL  to  another  ACL 
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and  the  fol  low  inti  kinds  of  ACLs  are  maintained: 

-  Read  access  (may  read  only) 

-  Ur i to  Access  (may  urite,  if  no  other  user  is  using  the 
disk) 

-  Multiple  Access  (may  urite,  even  though  other  users  are 
using  the  disk) 

-  Control  Access  (may  modify  the  ACL  for  this  disk) 


If  audit  trails  arc  kept,  the  first  cylinder  of  each  minidisk  ui I  I 
be  set  aside  for  audit  trails  and,  possibly.  ACLs.  Hence,  the 
virtual  size  of  the  minidisk  will  ba  one  cylinder  smaller  than 
that  specified  by  the  SSO. 

e.  Free  space 

-  type 

-  name 

Uhen  an  existing  area  is  freed,  the  contents  should,  in  principle, 
be  erased  unless  the  area  is  being  reassigned  to  the  same  security 
level.  In  addition,  no  further  accesses  to  the  deleted  area 
should  be  alloued.  This  latter  consideration  brings  up  the 
problem  of  capability  revocation,  see  belou. 

f.  Delete  space  -  like  'Free  Space*  except  that  the  space  is  made 
permanently  unavailable  for  allocation  and  hence  need  not  be 
cleared  until  the  volume  is  deleted. 
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REVOCATION  OF  CAPABILITIES 

One  of  the  problems  encountered  in  capability-based  systems  is 
that  of  revoking  a  capability  after  it  has  been  granted  and  used, 
Uhen  a  pi.ocess  has  been  granted  a  capability  it  may  have  multiple 
links  to  the  control  blocks  which  represent  that  capability?  in 
some  systems  the  original  grantee  may  be  able,  in  turn,  to  grant 
the  capability  or  some  subset  to  other  processes.  Further,  there 
may  be  other  capabilities  that  depend  on  the  original  capability 
to  be  meaningful.  Deleting  the  original  capability  without 
deleting  those  dependent  on  it  may  produce  a  potential  security 
v  i  o  I  a  t  fon. 

There  is  a  denial  of  service  problem  uhich  further  complicates 
matters.  If  the  Security  Kernel  revokes  a  capability  without 
notice,  the  process  may  be  unable  to  continue  working.  Moving  an 
empty  chair  uon’ t  bother  anyone  -  unless  she  is  starting  to  sit 
down  in  it. 

A  number  of  approaches  to  this  problem  have  been  used  in  KVM.  The 
most  general  approach  is  an  extension  of  that  used  in  VM/370  - 
currently  granted  capabilities  are  never  revoked.  If,  while  a 
user  is  logged  on,  a  new  directory  is  created  in  which  his 
privileges  are  changed,  the  changes  do  not  take  effect  until  he 
logs  off  (thus  releasing  his  current  capabilites)  and  logs  back 
on.  If  the  changed  privilege  is  access  to  a  minidisk,  he  can  a  1 30 
get  the  new  privilege  by  detaching  the  virtual  device  (thus 
releasing  the  capability)  and  reLINKing  to  it  (thus  getting  the 
new  capability).  Similarly,  in  KVM  the  Initiator  will  be 
consulted  only  when  a  user  logs  on  to  the  system  or  attempts  to 
link  to  a  disk  or  have  a  device  attached.  As  long  as  he  is  using 
it,  changes  to  the  security  database  (the  Directory)  will  not 
affect  him. 

Another  approach  is  to  refuse  to  delete  capabilities  unless  all 
dependent  capabilties  have  also  been  deleted.  For  example,  the 
Kernel  uill  execute  the  Destroy  VM  call  only  if  all  page  frames, 
page  slots  and  address  spaces  belonging  to  the  subject  VM  have 
first  been  detached  or  destroyed.  Similarly,  an  NKCP  (process) 
can  be  destroyed  only  if  it  has  no  outstanding  requests  uhich  can 
cause  completion  signals  to  be  sent  to  the  non-existent  process. 
A  page  frame  may  not  be  released  by  a  process  if  the  process  has 
pending  I/O  involving  that  page  frame. 

Another  approach  involves  the  management  of  equivalent 
capabilities.  In  a  paging  system,  for  example,  all  page  frames 
and  page  slots  are  equivalent  to  each  other  outside  of  the  paging 
management  module.  Thus,  the  Kernel  can  safely  move  virtual  pages 
betueen  main  memory  and  OASD  without  notice  to  the  processes.  The 
Kernel  must,  however,  respect  certain  critical  regions  within 
NKCPs  when  the  status  of  a  page  is  expected  to  remain  constant. 
This  problem  is  discussed  more  completely  in  other  papers. 
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The  approach  used  in  managing  the  Directory  is  a  mixture  of 
several.  Thus,  user  ids  and  their  access  rights  can  be  freely 
changed  in  the  Directory  uithout  Interacting  with  current  use  of 
those  rights.  The  changes  uill  take  effect  when  the  user  releases 
his  current  use  of  the  capability.  Allocation  of  space  on  disk 
volumes  is  a  slightly  different  problem,  however.  If  a  minidisk 
i9  deleted  and  the  space  reassigned  while  a  process  is  using  it, 
another  process  may  get  access  to  the  reassigned  space,  resulting 
in  two  processes  with  read-write  access  to  the  same  disk  area  -  a 
clear  violation  of  KVfl’s  security  policy. 

To  avoid  such  a  violation,  we  forbid  deletion  of  DASD  space  while 
a  process  is  using  it.  If  the  SSO  requests  that  an  area  be  freed 
or  deleted,  the  Updater  will  send  a  message  to  the  Initator 
requesting  permission  to  do  so.  The  Initiator  will  reply  OK  if 
the  area  is  not  currently  in  use,  otherwise  NO.  In  either  case, 
the  Initiator  will  mark  the  area  as  unavailable  for  use  so  that  no 
process  will  be  granted  use  of  it  while  the  SSO  is  updating  the 
directory,  then  the  SSO  finishes  updating  the  directory,  a  neu 
copy  is  created  and  the  Updater  notifies  the  Initator  to  use  the 
new  copy  for  all  future  requests.  Upon  receipt  of  that  message, 
the  Initiator  will  read  in  the  new  directory,  which  will  result  in 
all  ’unavailable'  marks  being  released. 

Finally,  in  order  to  allow  the  SSO  to  conveniently  do  his  work  In 
the  face  of  the  possibility  of  having  a  request  denied  because  the 
named  area  is  in  use.  we  add  the  following  requests: 
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5.  Create  and  replace  directories 

a.  Create  new  directory  -  when  the  SSO  is  satisfied  with  the 
changes  he  has  made,  he  can  cause  the  new  directory  to  be 
built  and  installed.  If  he  has  changed  the  security  level 
of  an  area,  he  will  be  required  to  confirm  his  desire  to 
erase,  up-  or  downgrade  the  contents  of  that  area. 

b.  Reuse  old  directory  -  when  the  SSO  has  begun  a  series  of 
directory  changes  but  is  unable  to  complete  them  due  to 
denial  of  a  request  or  a  typing  error,  he  can  request  that 
the  old  directory  be  re- i ns ta I  I ed.  This  sends  a  message 
to  the  Initiator  causing  it  to  forget  all  its  'not 
available'  marks  and  continue  using  the  old  directory. 

c.  Start  over  -  if  the  SoO  has  a  problem  with  the  series  of 

directory  changes  he  i3  making,,  but  doesn’t  want  to 
release  the  ’not  available'  marks  on  his  relation 
requests,  he  can  request  the  Updater  to  start  over  with  a 

fresh  copy  of  the  old  directory  for  him  to  update,  in 

effect  ’forgetting’  all  changes  he  has  made  while 
preventing  any  access  to  areas  he  wants  to  reassign. 

Note  that  if  the  area  is  in  use,  the  SSO’s  request  will  be 

denied,  but  'not  available’  flags  will  still  be  set,  so 

that  the  area  will  eventually,  as  processes  log  off,  be 
available  for  freeing. 
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3.5.2:  Updater  Process 

Formal  Specification 


module  UpdaterProcess 

type 

Char, 

String  «  list  of  Char. 

Dev i ceAddress, 

L i neAddress, 

Vo  I ume I d, 

ProcessName, 

Virtual  Mach i neName. 

Dev  i  cel ypes  -  (Reader . Pr i n  ter , Punch, T apeDr i ve , Nonshar ab I eD i sk) 
constant 

Dom i nates (ProcessName.ProcessName) :  boolean, 

Dev . ceType  (Dev i ceAddress) :  De  /  i ceTypee, 
wnaxCyl indcrs:  integer, 

^Cy I i nders  (Vo  I umel d) :  integer 
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TN-6062/101/00 


type 

AccessNodes  -  (Read, Ur i te) , 

Poss  i  b I eEn tr  i  es  -  (Pay i ng, Spoo I ing.fliniDi sk.Unknoun, System) , 

Cyllnt  -  T"1  :  integer  (1  <«!&!<.  #NaxCy  I  i  nders) , 

OirectoruEntry  -  structure  of  ( 

Userid  =»  V  i  r  tua IMachi neName, 

LogonPassuord  «  String, 

D i a iPassuord  «  String, 

LinkPassuord  ■  String, 

NaxSccLevel  =*  ProcessName, 
fl  i  nSecLeve  I  ProcessName, 

Ocd i catedDcv i ccs  «  set  of  OedicatedOcviceEntry, 

Links  =  set  of  NDLinkEntry, 

IplOcfincd  *  boolean, 

AccccsPassiiords  -  set  of  AccessPassuordEntry) , 

LineEntry  *  structure  of  ( 

Laddr  »  L i noAddross, 

Hi nSecLeve I  =  ProcessName, 

NaxSecLcvel  -  ProcessName), 

AccessPassuordEntry  =>  structure  of  ( 

SecLevel  »  ProcessName. 

Passuord  -  Str ing) , 

OedicatedOcviceEntry  =  structure  of  ( 

Raddr  Ocv r ceAddress, 

VolScclcvel  "  ProcessName, 

Access  n  set  of  AccessNodes), 

NDLi nkEntry  -  structure  of  ( 

NDNanio  «  N  i  n  if) i  skName, 

Acreos  =  set  of  AccessNodes), 

URPOunedOev i ceEn try  ~  structure  of  ( 

Raddr  »  Dov i ceAddress, 

NaxSccLevel  ■  ProcessName, 

N i nSecLeve I  «  Pr ocessName) , 

NonsharableOr iveEntry  =  structure  of  ( 

Raddr  »  Dev i ceAddress, 

NaxSccLevel  "  ProcessName, 

Ni nSecLeve I  -  ProcessName), 

Sharab I eDr i veEn try  ■  structure  of  ( 

Raddr  »  Dev i ceAddress, 

SccLcvel  ■  ProcessName), 
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SharedVo I umeEn tru  =  structure  of  ( 

Volume  =  Volume!  cl, 

SecLovel  -  ProcessName, 

Map  »  set  of  Cyl Map) . 

Cylflap  ■  structure  of  ( 

Cij I  inders  ■  Cyl 1 n t  ><  Cyl  Int, 
Coteyory  «  Poooi b I eEntr i es) , 

Mi  n iOi  skEntry  «=  structure  of  ( 
nONumc  ■»  fl  i  n  i  □  i  okName , 

Con  ta  i  n  i  ncjVo  I  ume  *  Volumeld, 
Cylinders  *-•  Cyilnt  ><  Cyl  Int, 
SecLevel  =  ProcessName, 
AccessControlList  -  set  of  ACLEntry), 

ACLEntry  -  structure  of  ( 

User  a  Virtual liach i neName , 

Access  *•  set  of  Accessflodea) 
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Ttt- 60G2/1 01/00 


var i  ab  I  e 

URPOmcc/Ocvices:  cot  of  URPOwedDeviceEntry. 

^°r<VC3i  Sct  of  NonsharableDriveCntry, 
SharablcDr  ivee:  set  of  Sharab I eDr  i  veEntry,  y 
set  of  SharedVolumeEntry. 


SharedVo / umeci 


niniOisks:  set  of  fliniOi  skEntry, 
Lines;  set  of  LineEntry, 

(JserO  i  rec  tory  s  set  of  D  i  rec  toryEn try 
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3.5.2  Updater  Process  (Formal)  TM-G062/101/00 


transform  Updater  Process 


ef  feet  Gist inctDeviceAridresses 
& 

Leya lUserO i rec  tory 

& 

Lrria  I L  i  nes 
&  ' 

Leya IM i n i □ i sks 
& 

Leya  I  SharedVo I umes 

& 

Leya  I Shar ab I eDr i ves 
& 

Lega I Nonsharab I eOr i ves 
& 

Lega I URPOwnedOev i ces 
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0  i  s t i nc tOcv i ceAddrcsscs  * 

A"U: URPOunedOev i ceEn try (U<: URPOunedOev ices  -> 

(A"NS: Nonsharab I eOr i veEntry (NS<: Nonsharab I eDr i ves  -> 
(U.Raddr  *.«  NS.Raddr)) 

& 

A"S : Sharab I eOr i veEntry (S<: Shar ab I eOr i ves  -> 

(U.Raddr  <*«•  S.Raddr)))) 

& 

A  "NS: Nonsharab I eOr i veEntry (NS<: Nonsharab ! eOr i ves  -> 

A"S:  Sharab  I  eDr  i  veEntry  (Sc  Sharab  I  eDr  i  ves  -> 

NS.Raddr  S.Raddr)) 
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LegalUserOirectory  - 

A"Ul ,U2: 0 i rec toryEntry  (U1 <sUserD i rectory 

& 

U2<:UserDi rectory  -> 
(Ul.Usorld  -  U2. Userid  ->  U1  •  U2) ) 

& 

A"U:DirectoryEntry(U<sUserDirectory  -> 

(flom i na  tes  (U. HaxSecLeve I  ,U. Hi nSecLeve I ) 

& 

Leya  I Ded i ca tedOev i ces (U) 

& 

Leya  I L i nks (U) 

& 

LeyalAccessPassuords(U) ) ) 
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Lega lOed i ca tedOev i ces (U: D i rec toryEn try)  - 

A  "El ,  E2:0c*di  ca  tedOev  iceEn  try  (El  cU.Dedi  ca  tedOev  ices 

4 

E2<: U. Ded i catedDev i ces  -> 
(El. Raddr  «  E2. Raddr  ->  El  •  E2) ) 

& 

A"E:DedicatedOeviceEntry (EcU.DedicatedOevices  -> 

E "D : URPOunedOev i ceEn try (D< s URPOwnedDev ices  4 
(D.Raddr  -  E.Raddr 
4 

(Dev i ceType (E. Raddr)  ■  Reader  -> 

(E. Vo ISecLeve I  *  ni I 
4 

E. Access  -  S"(Read))) 

4 

(Dev i ceType (E.Raddr) <:S" (Pr i nter,  Punch)  -> 

(E. VolSecLevel  -nil 
4 

E. Access  -  S" (Ur i te) ) ) 

4 

(Dev i ceType (Raddr)  -  TapeDrive  ~> 

(Oominates(O.HaxSecLevel ,E. VolSecLevel ) 
4 

Dom i nates (E. VolSecLevel .D.HinSecLevel ) 
4 

0ominates(U.f1axSecLevel  ,E.  VolSecLsvel ) 
4 

-Empty (E. Access) ) ) 

)) 

xor 

E"D: Nonsharab I eOr i veEntry (D<; Nonsharab I eDr i ves  & 
(□.Raddr  -  E.Raddr 
4 

Dom  i  nates  (O.flaxSecLeve  I ,  E.  Vo  I  SecLeve  I ) 

4 

Dominates  (E.  VolSecLevel  .D.TtinSecLevel ) 

4 

Dominates (U.MaxSecLevel ,E. VolSecLevel ) 

4  ' 

-Empty (E. Access) ? ) ) 

4 
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A  "LI  ,L2:  MCLinkEn  try  (Lie  U.  Links 

& 

L2<:U. Links  -> 

(Ll.MDName  -  L2.riDName  ->  Ll  -  L2 ) ) 

& 

A"L:nDLinKEntry(L<jU. Links  -> 

E " n : M i  n i D i  skEntry  (McfliniDi  sks  & 

(M. MOName  -  L.MOName 
& 

E"A:  ACLEntry  (A<;f1.  AccessControlLi  at  & 
(A. User  ■  U. Userid 
& 

A  "AH:  Accessflodes  (AflcL.  Access  -> 
Ah<: A. Access) ) ) 

& 

Dominates  (U.MaxSecLevel  .tl.SecLevel ) ) ) 

& 

•vEmpty  (L.Acco33) ) 
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Lega  I  Accesses  swords  (UjDirectoryEntry)  - 

A"A1 ,  A2j  AccessPasawordEntry  (AlcU.  AccessPassworda 

& 

A2<:U. AccessPassworda  -> 
(Al.SecLevel  -  A2.SecLevel  ->  A1  ■  A2)) 

"A: AccescPa9suordEntry (Ac U. AccessPassworda  -> 

(Dom i nates  (U. flaxSecLeve I ,  A. SecLeve I ) 

& 

Dominates (A. SecLeve I .U.MinSecLevel ) ) ) 
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TM-S0S2/1 01/30 


LegalLines  « 

A  "LI  ,L2:L  i  noEn  try  (LlcL  i  nes 
& 

L2<:Lines  - 
(Ll.Laddr  «  L2.Laddr  ->  LI 

"L:LinoEntry(L<:Lines  -> 

Dom i nates (L . tlaxSecLevel ,L 


-  L2) ) 

MinSecLevel ) ) 


21  May  1978  c  .  _ 

3-5.2  Updater  Process  (Formal)  Sy*  *m  Development  Corporation 

mau  Trt-6082/1 01/00 


Lega 111 i n i Di sks  » 


A  "HI ,  (12:  Mi  n  i 0  i  skEn  try  (Ml  <:I1  i  n  iD  i  sks 

& 


& 

A" 


flsttiniOi  skEntry  (McMiniOi  sks  -> 

(Lega  I  Con  ta  i  n  i  ngVo  I  ume  (ft) 


J’Cyl  i nders.  1  <  fl.Cyl  inders.2 


M.Cyl i nders. 2  <-#Cy I i ndar s (M. Conta i n i ngVo I ume) 

Jl.Cyl  indent. 1  <  #Cyl  indars(fl.ContainlngVolume) 


LegalAccessControlUst  (11) ) ) 
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System  Development  Corporation 

Tn-S0G2/lBl/00 


Lega  I  Con ta i n i ngVo I ume ( M : M I n i 0 i skEntry )  ■ 

E  "S :  Shared Vo  I umeEn  try { S < t Shar edVo I umes  & 
(S. Volume  -  M.ContaininciYolunn 

& 

Dominates (S.SecLeve I .n.SecLevel ) ) ) 
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System  Development  Corporation 
Ttt-6062/101/00 


Lega I AccessCon tro  IL  i  s t  (f1:Mi n iOi  skEntry)  * 

A"  A1 ,  A2:  ACLEn  try  (Ale  fl.  AccessCon  tro  IL  i  s  t 
& 

A2<sf1.AccessControlLi  st  -> 
(Al.User  -  A2.User  ->  A1  ■  A2) ) 

& 

A" A:  ACLEn  try  (A<:M. AccessCon tro  I L  i  st  -> 

(E"0: D i rec toryEntry (D<: UserD i r ec tory  & 
(0. Userid  -  A. User)) 

'  & 

~Empty  (A. Access) ) ) 
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Lega I SharedVo I umes 


A  SI ,  S2: SharedVo I umeEn try (SI <: SharedVo I umes 

& 

x/  ,  __  w  S2<:  SharedVo  I  umes  -> 

(SI. Volume  *  S2. Volume  ->  SI  «  S2) ) 

o 

A  S:  SharedVo I ume£ntry(S<s SharedVo I umes  -> 
(LegalHap(S))) 
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System  Development  Corporation 
Th-6062/101/08 


Legainap(S:SharedVolumeEntry!  ■ 

Av  .ion-over  I  ap  */ 

A"m,n2:Cymap(ni<:S.nap 

& 

MZcS.Map  -> 

(Hl.Cy I  inders.  1  >  f12.Cy I  inders.2 
I 

HI .  Cy  I  i  nder s.  2  <  M2.Cy  I  i  nders.  1 ) ) 

& 

A"n:CylMapm<:S.Map  -> 

(/*  each  entry  non-empty  */ 

M.Cy I inders.2  >  n.Cyl inders.  1 

<S 

/*  no  cylinders  unaccounted  for  */ 

n. Cy I i nder s. 2  #Cy I i nder s (S. Vo  I ume)  -> 

E"f11  :Cy IHap (MlcS.Maps  & 

ni. Cylinders. 1  -  tl.  Cy  I  i  nder  s.  2  +  1))) 

& 

E"n:Cyinap(M<:S.nap  & 

(n.Cyl i nders. 1  »  1 ) ) 

& 

/ >v  each  niniOisk  actually  logged  */ 

A"n:Cyinap(n<:S.nap  -> 

(n. Category  -  M i n i D i sk  -> 

E"MD:l1i  niDi  skEntry  (nDctti  niDi  sks  & 
(nQ.ContainingVolume  -  S. Volume 
& 

HQ, Cylinders  ■  n.Cy I i nders) ) ) ) 


21  May  1978  System  Development  Corporation 

3.5.2  Updater  Process  (Formal)  Tfl-6062/101/00 


Lega I Sharab I eDr i ves  ■ 

A  "SOI , S02; Sharab I eOr i veEn  try (SDlo  Sharab I eDr i ves 

& 

SD2<: Sharab I eDri ves  -> 
(SDl.Raddr  -  SD2.Raddr  ->  SOI  -  SD2) ) 


359 


21  flay  1978 
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Sustem  Development  Corporation 

TH-68S2/1B1/BB 


Lega INon9harab I eDr i ves  - 

A"NS1  ,NS2:Nonsharab  I  eDr  i  veEntry  (NSlcNonsharableDr  i  ves 

NS2<:NonsharableDr ives  -> 
(NSl.Raddr  *  NS2.Raddr  ->  NS1  -  :JS2)) 

£ 

A"NSs Nonshar ab I eDr i veEntry  (NS<: Nonshar ab I  eDr i ves  -> 
Dominates (NS.flaxSecLavel , NS.MinSecLevel ) ) 


3E0 
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3.5.2  Updater  Process 


(Forma  I ) 


Lega I URPOwnedOev i ces  - 

A"  U1 , U2 : URPOwnedOev i ceEn  try (U1 < i URPOwnedOev ices 

U2<  s  URPOwnedOev i ces  -> 

(Ui.Raddr  -  U2.Raddr  ->  U1  •  UZ)) 

A"U:  URPOwnedOev i ceEn  try  (U<: URPOwnedOev i ces  -> 

(Com i nates (U. naxSecLeve I ,U.Mi nSectevel ) 

p 

Dev i ceType (Raddr ) <: S" (Reader , Pr i n  ter .Punch, T apeDr « ve> ) > 
end  UpdaterProcess 


I 

I 


i 


